Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
#U5b89#U88c5#U52a9#U624b1.0.1.exe

Overview

General Information

Sample name:#U5b89#U88c5#U52a9#U624b1.0.1.exe
renamed because original name is a hash value
Original sample name:1.0.1.exe
Analysis ID:1580229
MD5:f2845d6410a0d9a090d414f3ae742e3b
SHA1:a27e62687254f001c08b5313465d2ed1870f0eb5
SHA256:f56c3d038c408355f6fb191865ca5650b29926f65b78d02b008b509bf640e588
Tags:exeSilverFoxwinosuser-kafan_shengui
Infos:

Detection

Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Adds a directory exclusion to Windows Defender
Contains functionality to hide a thread from the debugger
Found driver which could be used to inject code into processes
Hides threads from debuggers
Loading BitLocker PowerShell Module
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: New Kernel Driver Via SC.EXE
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • #U5b89#U88c5#U52a9#U624b1.0.1.exe (PID: 1360 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" MD5: F2845D6410A0D9A090D414F3AE742E3B)
    • #U5b89#U88c5#U52a9#U624b1.0.1.tmp (PID: 2076 cmdline: "C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" MD5: F0D4EEA505CEB561AB4AD622E3C0B9D5)
      • powershell.exe (PID: 2352 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 6572 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • #U5b89#U88c5#U52a9#U624b1.0.1.exe (PID: 5808 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENT MD5: F2845D6410A0D9A090D414F3AE742E3B)
        • #U5b89#U88c5#U52a9#U624b1.0.1.tmp (PID: 1812 cmdline: "C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$5046E,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENT MD5: F0D4EEA505CEB561AB4AD622E3C0B9D5)
          • 7zr.exe (PID: 6204 cmdline: 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • 7zr.exe (PID: 2300 cmdline: 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 3116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5692 cmdline: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6768 cmdline: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3560 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1492 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4304 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4508 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7064 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1644 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2820 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5704 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2284 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5600 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2076 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5144 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7056 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6768 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4744 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6208 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3992 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2472 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2284 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3116 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2124 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7056 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7064 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6204 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6208 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3292 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5296 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2300 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1684 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4612 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7060 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1276 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1564 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6204 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5560 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3292 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1372 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2284 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5248 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2504 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1864 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4708 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3752 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2608 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6208 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1292 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1536 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6460 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5296 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4284 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7116 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3480 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6524 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7128 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2408 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5228 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3652 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7064 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5908 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6180 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2352 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp, ParentProcessId: 2076, ParentProcessName: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2352, ProcessName: powershell.exe
Sigma detected: New Kernel Driver Via SC.EXE
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5692, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 6768, ProcessName: sc.exe
Sigma detected: Powershell Defender Exclusion
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp, ParentProcessId: 2076, ParentProcessName: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2352, ProcessName: powershell.exe
Sigma detected: New Service Creation Using Sc.EXE
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5692, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 6768, ProcessName: sc.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp, ParentProcessId: 2076, ParentProcessName: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 2352, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeVirustotal: Detection: 6%Perma Link
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000D.00000003.2170528884.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000D.00000003.2170634734.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.13.dr
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CC9AEC0 FindFirstFileA,FindClose,FindClose,7_2_6CC9AEC0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00186868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,11_2_00186868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00187496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,11_2_00187496
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://ocsp.digicert.com0A
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://ocsp.digicert.com0C
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://ocsp.digicert.com0H
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://ocsp.digicert.com0I
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://ocsp.digicert.com0X
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://www.digicert.com/CPS0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000003.2137286887.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, hrsw.vbc.7.dr, update.vac.7.dr, 7zr.exe.7.dr, update.vac.1.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046446817.000000007F99B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046093911.0000000003030000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000000.2047774569.0000000000A11000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000000.2140430410.0000000000D3D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.dr, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drString found in binary or memory: https://www.innosetup.com/
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046446817.000000007F99B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046093911.0000000003030000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000000.2047774569.0000000000A11000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000000.2140430410.0000000000D3D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.dr, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drString found in binary or memory: https://www.remobjects.com/ps

Operating System Destruction

barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: 01 00 00 00 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB23886 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,7_2_6CB23886
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA5120 NtSetInformationThread,OpenSCManagerA,CloseServiceHandle,OpenServiceA,CloseServiceHandle,7_2_6CCA5120
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB23C62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,7_2_6CB23C62
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB23D18 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,7_2_6CB23D18
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA5D60 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,7_2_6CCA5D60
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB23D62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,7_2_6CB23D62
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB239CF NtSetInformationThread,GetCurrentThread,NtSetInformationThread,7_2_6CB239CF
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB23A6A NtSetInformationThread,GetCurrentThread,NtSetInformationThread,7_2_6CB23A6A
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB21950: CreateFileA,DeviceIoControl,CloseHandle,7_2_6CB21950
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB24754 _strlen,CreateFileA,CreateFileA,CloseHandle,_strlen,std::ios_base::_Ios_base_dtor,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,TerminateProcess,GetCurrentProcess,TerminateProcess,_strlen,Sleep,ExitWindowsEx,Sleep,DeleteFileA,Sleep,_strlen,DeleteFileA,Sleep,_strlen,std::ios_base::_Ios_base_dtor,7_2_6CB24754
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB247547_2_6CB24754
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB34A277_2_6CB34A27
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA18807_2_6CCA1880
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA6A437_2_6CCA6A43
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD06CE07_2_6CD06CE0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD74DE07_2_6CD74DE0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD56D107_2_6CD56D10
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCF2EC97_2_6CCF2EC9
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5EEF07_2_6CD5EEF0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD2AEEF7_2_6CD2AEEF
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCD8EA17_2_6CCD8EA1
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD6C8D07_2_6CD6C8D0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD248967_2_6CD24896
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD748707_2_6CD74870
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD4E8107_2_6CD4E810
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD668207_2_6CD66820
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD769997_2_6CD76999
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD689507_2_6CD68950
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCD89727_2_6CCD8972
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD7A91A7_2_6CD7A91A
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD569007_2_6CD56900
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD6A9307_2_6CD6A930
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD64AA07_2_6CD64AA0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD30A527_2_6CD30A52
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD7AA007_2_6CD7AA00
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCE0BCA7_2_6CCE0BCA
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD6EBC07_2_6CD6EBC0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD4AB907_2_6CD4AB90
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCF0B667_2_6CCF0B66
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5E4D07_2_6CD5E4D0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD644897_2_6CD64489
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD384AC7_2_6CD384AC
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD545D07_2_6CD545D0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5C5807_2_6CD5C580
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD525807_2_6CD52580
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD425217_2_6CD42521
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD685207_2_6CD68520
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD746C07_2_6CD746C0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD6E6007_2_6CD6E600
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCDC7CF7_2_6CCDC7CF
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD767C07_2_6CD767C0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD3C7F37_2_6CD3C7F3
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD667A07_2_6CD667A0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5E0E07_2_6CD5E0E0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD500207_2_6CD50020
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD6C2A07_2_6CD6C2A0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD682007_2_6CD68200
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD75D907_2_6CD75D90
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD53D507_2_6CD53D50
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD27D437_2_6CD27D43
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD59E807_2_6CD59E80
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD31F117_2_6CD31F11
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD678C87_2_6CD678C8
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD4589F7_2_6CD4589F
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD599F07_2_6CD599F0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD4DAD07_2_6CD4DAD0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD51AA07_2_6CD51AA0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD4FA507_2_6CD4FA50
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCF540A7_2_6CCF540A
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5F5C07_2_6CD5F5C0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD1F5EC7_2_6CD1F5EC
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD596E07_2_6CD596E0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD4B6507_2_6CD4B650
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD6F6407_2_6CD6F640
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD737C07_2_6CD737C0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD797007_2_6CD79700
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCF30927_2_6CCF3092
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5F0507_2_6CD5F050
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD571F07_2_6CD571F0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5D2807_2_6CD5D280
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD5D3807_2_6CD5D380
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD66AF07_2_6CD66AF0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD637507_2_6CD63750
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001C81EC11_2_001C81EC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002081C011_2_002081C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001F425011_2_001F4250
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021824011_2_00218240
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021C3C011_2_0021C3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002104C811_2_002104C8
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001F865011_2_001F8650
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FC95011_2_001FC950
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001D094311_2_001D0943
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001F8C2011_2_001F8C20
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00210E0011_2_00210E00
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00214EA011_2_00214EA0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0020D08911_2_0020D089
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001E10AC11_2_001E10AC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021112011_2_00211120
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0020518011_2_00205180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FD1D011_2_001FD1D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002191C011_2_002191C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021D2C011_2_0021D2C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001853CF11_2_001853CF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001E53F311_2_001E53F3
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021D47011_2_0021D470
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001CD49611_2_001CD496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002154D011_2_002154D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0018157211_2_00181572
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021155011_2_00211550
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001D965211_2_001D9652
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0020D6A011_2_0020D6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0019976611_2_00199766
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001897CA11_2_001897CA
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021D9E011_2_0021D9E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00181AA111_2_00181AA1
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00205E8011_2_00205E80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00205F8011_2_00205F80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0019E00A11_2_0019E00A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002022E011_2_002022E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0022230011_2_00222300
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001EE49F11_2_001EE49F
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002025F011_2_002025F0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FA6A011_2_001FA6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001F66D011_2_001F66D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021E99011_2_0021E990
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00202A8011_2_00202A80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001DAB1111_2_001DAB11
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00206CE011_2_00206CE0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002070D011_2_002070D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001EB12111_2_001EB121
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FB18011_2_001FB180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021720011_2_00217200
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0020F3A011_2_0020F3A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021F3C011_2_0021F3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001AB3E411_2_001AB3E4
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0020F42011_2_0020F420
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001F741011_2_001F7410
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021353011_2_00213530
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FF50011_2_001FF500
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0022351A11_2_0022351A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021F59911_2_0021F599
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0022360111_2_00223601
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001F379011_2_001F3790
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002177C011_2_002177C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001AF8E011_2_001AF8E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FF91011_2_001FF910
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0019BAC911_2_0019BAC9
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00207AF011_2_00207AF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001D3AEF11_2_001D3AEF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00207C5011_2_00207C50
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0019BC9211_2_0019BC92
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001FFDF011_2_001FFDF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 00181E40 appears 172 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 0021FB10 appears 723 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 001828E3 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: String function: 6CD76F10 appears 728 times
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: String function: 6CCD9240 appears 53 times
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000000.2044306284.0000000000A99000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName7RMHWwyl1NfL.exe vs #U5b89#U88c5#U52a9#U624b1.0.1.exe
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046446817.000000007FC9A000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName7RMHWwyl1NfL.exe vs #U5b89#U88c5#U52a9#U624b1.0.1.exe
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046093911.000000000314E000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName7RMHWwyl1NfL.exe vs #U5b89#U88c5#U52a9#U624b1.0.1.exe
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeBinary or memory string: OriginalFileName7RMHWwyl1NfL.exe vs #U5b89#U88c5#U52a9#U624b1.0.1.exe
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: tProtect.dll.13.drBinary string: \Device\TfSysMon
Source: tProtect.dll.13.drBinary string: \Device\TfKbMonPWLCache
Source: classification engineClassification label: mal80.evad.winEXE@133/33@0/0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA5D60 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,7_2_6CCA5D60
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00189313 _isatty,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,11_2_00189313
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00193D66 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,11_2_00193D66
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00189252 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,11_2_00189252
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA5240 CreateToolhelp32Snapshot,CloseHandle,Process32NextW,Process32FirstW,7_2_6CCA5240
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Program Files (x86)\Windows NT\is-LHLK8.tmpJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1644:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1100:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1864:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1292:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6020:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3116:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3992:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1784:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2412:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4744:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4568:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2076:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2472:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3652:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6516:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1680:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2788:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6804:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4508:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2604:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2764:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5248:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6480:120:WilError_03
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeFile created: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmpJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeVirustotal: Detection: 6%
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeFile read: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp "C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENT
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp "C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$5046E,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENT
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp "C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp "C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$5046E,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9ialdJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpWindow found: window name: TMainFormJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic file information: File size 8595621 > 1048576
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000D.00000003.2170528884.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000D.00000003.2170634734.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.13.dr
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002057D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,11_2_002057D0
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drStatic PE information: real checksum: 0x0 should be: 0x3439cd
Source: update.vac.1.drStatic PE information: real checksum: 0x0 should be: 0x372ce7
Source: update.vac.7.drStatic PE information: real checksum: 0x0 should be: 0x372ce7
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: real checksum: 0x0 should be: 0x838234
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.drStatic PE information: real checksum: 0x0 should be: 0x3439cd
Source: hrsw.vbc.7.drStatic PE information: real checksum: 0x0 should be: 0x372ce7
Source: tProtect.dll.13.drStatic PE information: real checksum: 0x1eb0f should be: 0xfc66
Source: #U5b89#U88c5#U52a9#U624b1.0.1.exeStatic PE information: section name: .didata
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drStatic PE information: section name: .didata
Source: update.vac.1.drStatic PE information: section name: .00cfg
Source: update.vac.1.drStatic PE information: section name: .voltbl
Source: update.vac.1.drStatic PE information: section name: .8Tk
Source: #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.drStatic PE information: section name: .didata
Source: 7zr.exe.7.drStatic PE information: section name: .sxdata
Source: update.vac.7.drStatic PE information: section name: .00cfg
Source: update.vac.7.drStatic PE information: section name: .voltbl
Source: update.vac.7.drStatic PE information: section name: .8Tk
Source: hrsw.vbc.7.drStatic PE information: section name: .00cfg
Source: hrsw.vbc.7.drStatic PE information: section name: .voltbl
Source: hrsw.vbc.7.drStatic PE information: section name: .8Tk
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA86EB push ecx; ret 7_2_6CCA86FE
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB50F00 push ss; retn 0001h7_2_6CB50F0A
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD76F10 push eax; ret 7_2_6CD76F2E
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCDB9F4 push 004AC35Ch; ret 7_2_6CCDBA0E
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD77290 push eax; ret 7_2_6CD772BE
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_001845F4 push 0022C35Ch; ret 11_2_0018460E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021FB10 push eax; ret 11_2_0021FB2E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0021FE90 push eax; ret 11_2_0021FEBE
Source: update.vac.1.drStatic PE information: section name: .8Tk entropy: 7.190790923053346
Source: update.vac.7.drStatic PE information: section name: .8Tk entropy: 7.190790923053346
Source: hrsw.vbc.7.drStatic PE information: section name: .8Tk entropy: 7.190790923053346
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\update.vacJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeFile created: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Program Files (x86)\Windows NT\7zr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-L8408.tmp\update.vacJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeFile created: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeFile created: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-L8408.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-L8408.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6458Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3333Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpWindow / User API: threadDelayed 620Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpWindow / User API: threadDelayed 597Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\update.vacJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-L8408.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-L8408.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeAPI coverage: 7.6 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6084Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CC9AEC0 FindFirstFileA,FindClose,FindClose,7_2_6CC9AEC0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00186868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,11_2_00186868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00187496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,11_2_00187496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00189C60 GetSystemInfo,11_2_00189C60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CB23886 NtSetInformationThread 00000000,00000011,00000000,000000007_2_6CB23886
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCB0181 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6CCB0181
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_002057D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,11_2_002057D0
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCB9D66 mov eax, dword ptr fs:[00000030h]7_2_6CCB9D66
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCB9D35 mov eax, dword ptr fs:[00000030h]7_2_6CCB9D35
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCAF17D mov eax, dword ptr fs:[00000030h]7_2_6CCAF17D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCA8CBD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_6CCA8CBD
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CCB0181 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_6CCB0181

HIPS / PFW / Operating System Protection Evasion

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Found driver which could be used to inject code into processes
Source: tProtect.dll.13.drStatic PE information: Found potential injection code
Source: C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmpCode function: 7_2_6CD77700 cpuid 7_2_6CD77700
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_0018AB2A GetSystemTimeAsFileTime,11_2_0018AB2A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 11_2_00220090 GetVersion,11_2_00220090

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
Windows Service		1
Access Token Manipulation		11
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Service Execution		1
DLL Side-Loading		1
Windows Service		1
Disable or Modify Tools		LSASS Memory32
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Native API		Logon Script (Windows)111
Process Injection		231
Virtualization/Sandbox Evasion		Security Account Manager231
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
Access Token Manipulation		NTDS2
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script111
Process Injection		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Deobfuscate/Decode Files or Information		Cached Domain Credentials2
System Owner/User Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
Obfuscated Files or Information		DCSync3
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Software Packing		Proc Filesystem25
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
DLL Side-Loading		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580229 Sample: #U5b89#U88c5#U52a9#U624b1.0.1.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 80 90 Multi AV Scanner detection for submitted file 2->90 92 Found driver which could be used to inject code into processes 2->92 94 Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet 2->94 10 #U5b89#U88c5#U52a9#U624b1.0.1.exe 2 2->10         started        13 cmd.exe 2->13         started        15 cmd.exe 2->15         started        17 30 other processes 2->17 process3 file4 86 C:\...\#U5b89#U88c5#U52a9#U624b1.0.1.tmp, PE32 10->86 dropped 19 #U5b89#U88c5#U52a9#U624b1.0.1.tmp 3 5 10->19         started        23 sc.exe 1 13->23         started        25 sc.exe 1 15->25         started        27 sc.exe 1 17->27         started        29 sc.exe 1 17->29         started        31 sc.exe 1 17->31         started        33 26 other processes 17->33 process5 file6 72 C:\Users\user\AppData\Local\...\update.vac, PE32 19->72 dropped 74 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 19->74 dropped 96 Adds a directory exclusion to Windows Defender 19->96 35 #U5b89#U88c5#U52a9#U624b1.0.1.exe 2 19->35         started        38 powershell.exe 23 19->38         started        41 conhost.exe 23->41         started        43 conhost.exe 25->43         started        45 conhost.exe 27->45         started        47 conhost.exe 29->47         started        49 conhost.exe 31->49         started        51 conhost.exe 33->51         started        53 25 other processes 33->53 signatures7 process8 file9 76 C:\...\#U5b89#U88c5#U52a9#U624b1.0.1.tmp, PE32 35->76 dropped 55 #U5b89#U88c5#U52a9#U624b1.0.1.tmp 4 16 35->55         started        98 Loading BitLocker PowerShell Module 38->98 59 conhost.exe 38->59         started        61 WmiPrvSE.exe 38->61         started        signatures10 process11 file12 78 C:\Users\user\AppData\Local\...\update.vac, PE32 55->78 dropped 80 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 55->80 dropped 82 C:\Program Files (x86)\Windows NT\hrsw.vbc, PE32 55->82 dropped 84 C:\Program Files (x86)\Windows NT\7zr.exe, PE32 55->84 dropped 100 Query firmware table information (likely to detect VMs) 55->100 102 Protects its processes via BreakOnTermination flag 55->102 104 Hides threads from debuggers 55->104 106 Contains functionality to hide a thread from the debugger 55->106 63 7zr.exe 2 55->63         started        66 7zr.exe 7 55->66         started        signatures13 process14 file15 88 C:\Program Files (x86)\...\tProtect.dll, PE32+ 63->88 dropped 68 conhost.exe 63->68         started        70 conhost.exe 66->70         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
#U5b89#U88c5#U52a9#U624b1.0.1.exe0%ReversingLabs
#U5b89#U88c5#U52a9#U624b1.0.1.exe7%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\Windows NT\7zr.exe0%ReversingLabs
C:\Program Files (x86)\Windows NT\tProtect.dll9%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-L8408.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\_isetup\_setup64.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU#U5b89#U88c5#U52a9#U624b1.0.1.exefalse
    		high
    https://www.remobjects.com/ps#U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046446817.000000007F99B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046093911.0000000003030000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000000.2047774569.0000000000A11000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000000.2140430410.0000000000D3D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.dr, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drfalse
      		high
      https://www.innosetup.com/#U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046446817.000000007F99B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.exe, 00000000.00000003.2046093911.0000000003030000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000001.00000000.2047774569.0000000000A11000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp, 00000007.00000000.2140430410.0000000000D3D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.6.dr, #U5b89#U88c5#U52a9#U624b1.0.1.tmp.0.drfalse
        		high

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1580229
        Start date and time:2024-12-24 05:01:24 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 10m 18s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Run name:Run with higher sleep bypass
        Number of analysed new started processes analysed:108
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Critical Process Termination
        Sample name:#U5b89#U88c5#U52a9#U624b1.0.1.exe
        renamed because original name is a hash value
        Original Sample Name:1.0.1.exe
        Detection:MAL
        Classification:mal80.evad.winEXE@133/33@0/0
        EGA Information:
        • Successful, ratio: 100%
        HCA Information:
        • Successful, ratio: 77%
        • Number of executed functions: 28
        • Number of non-executed functions: 76
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
        • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

        Warnings

        • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe
        • Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
        • Not all processes where analyzed, report is missing behavior information
        • Report size exceeded maximum capacity and may have missing behavior information.
        • Report size exceeded maximum capacity and may have missing disassembly code.
        • Report size getting too big, too many NtCreateKey calls found.
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        C:\Program Files (x86)\Windows NT\7zr.exe#U5b89#U88c5#U52a9#U624b1.0.3.exeGet hashmaliciousUnknownBrowse
          #U5b89#U88c5#U52a9#U624b1.0.2.exeGet hashmaliciousUnknownBrowse
            #U5b89#U88c5#U52a9#U624b1.0.2.exeGet hashmaliciousUnknownBrowse
              #U5b89#U88c5#U52a9#U624b_2.0.8.exeGet hashmaliciousUnknownBrowse
                #U5b89#U88c5#U52a9#U624b1.0.2.exeGet hashmaliciousUnknownBrowse
                  #U5b89#U88c5#U52a9#U624b_2.0.8.exeGet hashmaliciousUnknownBrowse
                    #U5b89#U88c5#U52a9#U624b_2.0.6.exeGet hashmaliciousUnknownBrowse
                      #U5b89#U88c5#U52a9#U624b_2.0.6.exeGet hashmaliciousUnknownBrowse
                        #U5b89#U88c5#U52a9#U624b_2.0.7.exeGet hashmaliciousUnknownBrowse

                          Created / dropped Files

                          C:\Program Files (x86)\Windows NT\7zr.exe

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:PE32 executable (console) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):831200
                          Entropy (8bit):6.671005303304742
                          Encrypted:false
                          SSDEEP:24576:A48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Ae71MzuiehWIKxZ
                          MD5:84DC4B92D860E8AEA55D12B1E87EA108
                          SHA1:56074A031A81A2394770D4DA98AC01D99EC77AAD
                          SHA-256:BA1EC2C30212F535231EBEB2D122BDA5DD0529D80769495CCFD74361803E3880
                          SHA-512:CF3552AD1F794582F406FB5A396477A2AA10FCF0210B2F06C3FC4E751DB02193FB9AA792CD994FA398462737E9F9FFA4F19F095A82FC48F860945E98F1B776B7
                          Malicious:false
                          Antivirus:
                          • Antivirus: ReversingLabs, Detection: 0%
                          Joe Sandbox View:
                          • Filename: #U5b89#U88c5#U52a9#U624b1.0.3.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b_2.0.8.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b_2.0.8.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b_2.0.6.exe, Detection: malicious, Browse
                          • Filename: #U5b89#U88c5#U52a9#U624b_2.0.7.exe, Detection: malicious, Browse
                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9A..} ..} ..} ...<... ...?..~ ...<..t ...?..v ...?... ...(.| ..} ... ...(.t ..K.... ..k_..~ ..K...~ ..f."._ ...R..x ...&..| ..Rich} ..........PE..L....\.d.....................N......:.............@..........................@............@.....................................x........................&.......d......................................................H............................text.............................. ..`.rdata..RZ.......\..................@..@.data...ds... ......................@....sxdata.............................@....rsrc...............................@..@.reloc..2r.......t..................@..B................................................................................................................................................................................................................................................

                          C:\Program Files (x86)\Windows NT\file.bin (copy)

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:data
                          Category:dropped
                          Size (bytes):2603681
                          Entropy (8bit):7.9999250486601365
                          Encrypted:true
                          SSDEEP:49152:CAQF5rEv9l8kq6OyoWZqzEwn9192vEpJ9syz09uPhPTehqd9zQwp7N8WyAhlBi:GFxEFCwiWDwn91vJ9Dzhd90wpRgH
                          MD5:3B9FD0924DB73BAA952BEB4A7BD7D6DE
                          SHA1:66C0C97BBF4B25A31F35CB8029593B472BE5F056
                          SHA-256:4A293DA92330E5FE2BD56DD600E245E2AB9BCAA15FA091BB04E60C6B23C3EF95
                          SHA-512:41CD19F53535FBC592C050AE70B40BB82799A9A955B516446864961E5E559EAC2B6AA7E0A47BF89FAB5B38A754EC426076635E514C0D1E87BEBCAA66C5E8E402
                          Malicious:false
                          Preview:.@S....+.YN.F..............4.%..6W.Bi6..B.i.|.M...>~rcE...2.@o.1....:..Y. ..j!}.).d..pi..T-......l.....`.W.T~.........Q...|..W.......,./..Z{..FqaLj.....o.+9N./....5..3Ix......i.i$C&.O}.Z..?..1-4.=....zw..5.N8.I;.D..Tv..@.....e\,?.7.Kx.6<S3kd.2...`..rd<..........N%..........=...V...#.._...#.m...V.L...'..W..T..5.u.A....g.fg).....FB....8....w../.......&Lts.3.{.S.c...dX.2.S..e......ls.WE.N.|l...3h!..a.M.K......lh.`............t.w}..,......adq]<.y;.....a.....$.c.tJ.U.l..Z.',.....:..2....:..5.....S[.98.cF..DL.F.o.<.o3K.*.h....f....i2%.........zIkZ.._.gh...@.h.u..-z.A..G...e..[...%..7.........'..{x>@A...&...(..UQ../..ZD.N...i..q.5&}.].<...(.wr...f.M....pn...UW^.....\...V..s....E...s._..~nv.%t,.........qQ..U...;)..wA...O.WB.x.,....N...{..._.{.w;..5..a.r.zY|b...l6...*.p.f........k.....o.0.+..ihu.,.^>.9vV..f.p.6~.2pf...j.@....wLO.kwhF.....3.wW.Y4..^...td}....Z...\...E..st4(.{,.\.W..4.....g.yq....G.^8..n..U<I.mS".....K.q........@@..e?.x3....

                          C:\Program Files (x86)\Windows NT\hrsw.vbc

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):3606528
                          Entropy (8bit):7.005604268954487
                          Encrypted:false
                          SSDEEP:98304:yLVLAJG42oakQdhme71MzSRTP/Se7NHaV:yZyTFaOe71MzSP/Se75g
                          MD5:1047AF726D2E233D71934EF55E635C4A
                          SHA1:AB12E827E4E57DEA2E885733F0C48E9A83756678
                          SHA-256:42934349F3C8D0EE1CD121B8386A5A6D28D7E8E54A251AE18AA0992D5897EC44
                          SHA-512:8A26268641B1B3F54ABE04CA2212FCA8BCCBD575DCDAB38F7E921FE9E01C29B99BCE25913642E658027A47E27AED795DD5FF3EF9DDC1077108BE29210052AF7E
                          Malicious:false
                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....gg...........!.....b..........%.........................................7...........@.........................HC.......J..<....07.X....................@7.$?..........................x........................K...............................text...`a.......b.................. ..`.rdata..<............f..............@..@.data................\..............@....00cfg.......`(.......(.............@..@.tls.........p(.......(.............@....voltbl.F.....(...... (..................8Tk....p.....(......"(............. ..`.rsrc...X....07.......6.............@..@.reloc..$?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                          C:\Program Files (x86)\Windows NT\is-18TF5.tmp

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:OpenPGP Secret Key
                          Category:dropped
                          Size (bytes):2353553
                          Entropy (8bit):7.99992611421159
                          Encrypted:true
                          SSDEEP:49152:rtfmdyArF7jC2uzD04c4vtHlkTmMVDfFv3ARw3ieIXzFj0nHfh:roDrBKxxlkq0fNAW3ieIXzuZ
                          MD5:73616E6FB705D7163A2D8A391DDCAD6C
                          SHA1:2ADEE96903C346D920E7B7B7527BE089F8388D87
                          SHA-256:4AE1FF98AEC7817FF9E35A15118CFBD61CCF00C766ABE08C4EEFB58889EDF04E
                          SHA-512:74D4726E6593783D062AFB2703C1B6465019C247DD2468B657AD95413BC4A3707F9D2695D9BE3CA51C9590A28C3ED22DDC52615F10F742A4432CD3A72A3A18FD
                          Malicious:false
                          Preview:....;.3......v.D.8.Wg..y.v.....u....Bwa...]`t...~..-..n.........9l..v.I}gwwT..7H.t?..6.G.x.-'7....]$...iq~....J`........$...(..m.z....,y..2C7.?...O...D.._..dP.&;....n .....a..l...#R......K.[&.eb.\&B..M..d .[.<.t\..W..,$........;@..........?.x..$+..Z...:.f....i.WL'..g .Xv1V....[f..._........+'.T.9..%...../v_)...G0........`(.J1+....U.l.9..2........Y..._K.....z.-......$..@E..c.J..c....B....h.;.5..2*I7>....e.L...R..M.0"jz'.....g......:...A.?s...]C3?.%.....;.."..1........\Q...d+..Z...:-..M.Q.o.P...Y...`%O..I.f?.Kb...2./'].?Qq....+f..)..g*["9.0.S..T+A...Z..v....Y...uR(.....3....&kD....D.+..v......Of,.D....Vz.9.9jZ.d...f...c..m.[Y....|5.jV.....Oq...5.t|.. N.P..~...a...5.......3.<++'...=..<.....l..!_.o9L.:..y..g.T.\...H.@....../t..<L.F.q1..B.!.9+|.s}e4.j*Zbg_W..t..{.&xY.q.8.=M...8.O..x..._]6h%....g.....~.O..........$..p.~!.E[.*!.+b.EH.......)..2.).KH.....(p...%u......!.t\+.....R. .$.ir...m.L+IC...OD....:26..y.j.x<L.?u.R.........x...........[.

                          C:\Program Files (x86)\Windows NT\is-LHLK8.tmp

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:data
                          Category:dropped
                          Size (bytes):2603681
                          Entropy (8bit):7.9999250486601365
                          Encrypted:true
                          SSDEEP:49152:CAQF5rEv9l8kq6OyoWZqzEwn9192vEpJ9syz09uPhPTehqd9zQwp7N8WyAhlBi:GFxEFCwiWDwn91vJ9Dzhd90wpRgH
                          MD5:3B9FD0924DB73BAA952BEB4A7BD7D6DE
                          SHA1:66C0C97BBF4B25A31F35CB8029593B472BE5F056
                          SHA-256:4A293DA92330E5FE2BD56DD600E245E2AB9BCAA15FA091BB04E60C6B23C3EF95
                          SHA-512:41CD19F53535FBC592C050AE70B40BB82799A9A955B516446864961E5E559EAC2B6AA7E0A47BF89FAB5B38A754EC426076635E514C0D1E87BEBCAA66C5E8E402
                          Malicious:false
                          Preview:.@S....+.YN.F..............4.%..6W.Bi6..B.i.|.M...>~rcE...2.@o.1....:..Y. ..j!}.).d..pi..T-......l.....`.W.T~.........Q...|..W.......,./..Z{..FqaLj.....o.+9N./....5..3Ix......i.i$C&.O}.Z..?..1-4.=....zw..5.N8.I;.D..Tv..@.....e\,?.7.Kx.6<S3kd.2...`..rd<..........N%..........=...V...#.._...#.m...V.L...'..W..T..5.u.A....g.fg).....FB....8....w../.......&Lts.3.{.S.c...dX.2.S..e......ls.WE.N.|l...3h!..a.M.K......lh.`............t.w}..,......adq]<.y;.....a.....$.c.tJ.U.l..Z.',.....:..2....:..5.....S[.98.cF..DL.F.o.<.o3K.*.h....f....i2%.........zIkZ.._.gh...@.h.u..-z.A..G...e..[...%..7.........'..{x>@A...&...(..UQ../..ZD.N...i..q.5&}.].<...(.wr...f.M....pn...UW^.....\...V..s....E...s._..~nv.%t,.........qQ..U...;)..wA...O.WB.x.,....N...{..._.{.w;..5..a.r.zY|b...l6...*.p.f........k.....o.0.+..ihu.,.^>.9vV..f.p.6~.2pf...j.@....wLO.kwhF.....3.wW.Y4..^...td}....Z...\...E..st4(.{,.\.W..4.....g.yq....G.^8..n..U<I.mS".....K.q........@@..e?.x3....

                          C:\Program Files (x86)\Windows NT\locale.bin

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):56514
                          Entropy (8bit):7.996871451143694
                          Encrypted:true
                          SSDEEP:1536:mPAiXXCuGhffQfTWvMcdyw9W0wV/JQ+PX7D0sC1pr7MN2c3:mL5iQfTWvM9/S+/0fMAM
                          MD5:F8884F03FE2A94096CD9DB4DFFE29A40
                          SHA1:A139A68287F4E3FF9486273AA0E8CE16432CF819
                          SHA-256:5D3E892B057465CC9D66CF84268CA7FBB040EF8A797653B99597E6E9DDA16D35
                          SHA-512:F3EAC63B1A4D05BAEC1CD79522D8B65EB9F72E6F72DD4A38C62FF90165067266A08E0CEC9A9DBF6E1C68D228B0E89D37A83C68B334AF22ADD23CD3E9C7F20390
                          Malicious:false
                          Preview:.@S....f... ..............`.......uw..R.).......\.3...Wz......7v#....$D....+.V.}....r.!.!..&.y}.t......K%sG.6.W|m..'.v...jZ!.j6nd....u$.P}..$..a34c..K.R...5H...."..c....4.......M..7g.G..6..Y.e..~.....d....;Gn._o .G.qp...J..ao.z[...F%.S...&...J>@...............RF....P.>`.....K22.......[dgUc.R..R.U......D.my...|...qOvRO...}.)!VD'c...(....R...zi~U..zZV.ps._....iw..v....{..!..x.6....nH......o.......g...{....[.f...NA......l.2..bP.Ng...T..0...u..c..^.Y..n.\.&.#...rn...#.Vk[G.#.?....Z'|.:e..A.].4..B..?=K..Y..~.aqp...H....V..t....'.=...e.X.t......}....N..\.|..VZ..).Fr.....X..n9...6..Y..o.ZWi...1...*..[.A.e.l....).r..2]...Q<O$$d./!.?..f\..7a.'..tfh.5Dz:..i..r1M.w..U.y......1...J ...o.2...0.{..).Zf.....S....j.TQ..!....T.0p?..+.T...rG.D.x:3......f.D8....nT.v..nK...cT......}.1.r...<..&.?V..F...u.....x..z..'...5l...*.?.....W..=.G......Q...\.....b..Q..I..d-...].[-?O.Q........u..2.=`<W.Z~..w..8P.$~..Y..=..B...l....8..A.h\....c.G..fqu,0...lI.]Bv.m.4....j....q....

                          C:\Program Files (x86)\Windows NT\locale.dat

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:7-zip archive data, version 0.4
                          Category:dropped
                          Size (bytes):56514
                          Entropy (8bit):7.9968714511436945
                          Encrypted:true
                          SSDEEP:1536:HokFPP32DIjpUKb0m13fiDdCu3ELc3d5wbMjeYIcJLYuJUWLxMBRc:Ho4PP6gb0OYdCcELwYtYIcJL32WiBRc
                          MD5:F872271BC29C420B64116E4FA31D04DC
                          SHA1:E009BDDF7E43633678F6259524E8AFF6EC85103D
                          SHA-256:081F6BD3EC3B5F9EE39F42942DD608C96134AE459734B031132DBF92ACBE751A
                          SHA-512:1803172A6CD5BA42CA257F057602CBBCC511CCB85FE86495C5708A2AE6563C40966E27A2C8768B8363ABD1A4028EAB53C7F81BDFADE9384CAB99A71B9B509A2C
                          Malicious:false
                          Preview:7z..'...... p.......2...........G`.k...2........%6.T..f.v...}/..&.^b...05.l..&.J;..W.s.Mw.a...s.>2t? ..i...G.....e..P..|..h...Z..1..%..`.XP.Bp....i...t...B8....\.n.)..m..j..n~.[..b.se.....E..R.Sm)..('IE..!p...~......r..V..$P..4fB.....V..N.....K.1wP...0okz.YL.g(.~.....2<.....U.=........4^.x.=...$.LG.0..V).........3.p"Z.H......../.P0.(>......L..........S.T..h+.5.0=.h..H..V;...$.. .G..}.n:4!9.9V]Y..9.....=G..G.OE+.0./...7..B!3.<..P6.z.&...a.P.r........ci .-....q.S.ys.l.....Z. ...O{.......&.^p.>....O..,GK.m..8...K....,.c.U....-.Z..I.p/.j2H.!......X..,.h.L..5..6...E..u....U~U..{)..6J..*.s..~n.p.]......n.....,....].O=.e.my........i.As....rP....Z.2....V..5...U.......".....$3.o.P.....3.I...3..9<N.~..*xQ...qi....[....,4Uh.d(.1H..Q.l9.....I...(9....;..7.=...M....y.|..4..1..vY#.@.8.Y.}2.E<..gP*...\{.....X.m.f.+4...b|....swd....<...2g.. Sr......>.&....hl.e.......U..Y.....{.p0.y..'..O.<.}.d*.T;.._/zHM....3.....EFp.."q.....r.*R....h7\....:

                          C:\Program Files (x86)\Windows NT\locale2.bin

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):56546
                          Entropy (8bit):7.996966859255975
                          Encrypted:true
                          SSDEEP:1536:crCPEbYP46GiC3q6cGOlLvjmS9UWgvy/F2QFtTVAe:iCIR913q8wjmS9bhKe
                          MD5:CEA69F993E1CE0FB945A98BF37A66546
                          SHA1:7114365265F041DA904574D1F5876544506F89BA
                          SHA-256:E834D26D571776C889E2D09892C6E562EA62CD6524D8FC625E6496A1742F5DBB
                          SHA-512:4BCBB5AD50446CD4FAD5ED3C530E29CC9DD7DDCB7B912D7C546AF8CCF7DA74BC1EEC397846BFB97858BABC9AA46BB3F3D0434F414BBC3B15B9FDBB7BF3ED59F9
                          Malicious:false
                          Preview:.@S....c...l ...............3...Q...R]..u&.(..c...o.A..q?oIS.j..O[..o..&....L)......Rm.jC,./....-=...Z.;..7..tH..f...n#.7.P#..#o..D..y....m........zH.!...M.|......Vs.^.Rb.X`....y.T.Sg....T.....E.?/.H.;h.)P.#.pz.LOG$..."L(.....?.D*.6g.J!.>.....f.....J..B..q...;w]9.v...V...$....L/m.H#..]...G....QQ..'.z.!NW~..R..y....E.)....m.k%....+....>....02../..M....b.l..f7..f?-~_..E.5.~....*.'....8?.n........x...#....9.........q.q.n...\....D.Uv9.9...P.j7P~q9[BV...>C..[F..k-UL(jfT..\..{d.v;.5.e.fb.3^+...Z|]S3G...$..H=.W..c...B...).v.D!...s...+.K...~=..l.2...X.m.-....m0.....p...>...d......e.J..gUr*4....vw.........T.cQ......\...]...Z{..q..n..'Ql.$..V.U9..j 4...9<..6i.....5.F.).k.LQ4.H...2..p.*.bQJ..4.K'C...#.%"q.u../zoXL...L...........'..g11=E.....y.8...~.Oe..X....u.M8.T.....Qq.m.........i....F.4e.([Hm.*...E....2........s. *R..{."4.x.]...-.....xQ@.z.......Bz.).[..C...T..".....q............M.X..CQ..A..........d...`S.3...e.X.....u.>.!..;k...>..

                          C:\Program Files (x86)\Windows NT\locale2.dat

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:7-zip archive data, version 0.4
                          Category:dropped
                          Size (bytes):56546
                          Entropy (8bit):7.996966859255979
                          Encrypted:true
                          SSDEEP:1536:cWsX30GkPK2rw7bphKKdxDBxjqtalDFMflaX4:cZXhkPhr+TRJqtaK
                          MD5:4CB8B7E557C80FC7B014133AB834A042
                          SHA1:C42E2C861FF3ED0E6A11824E12F67A344E8F783D
                          SHA-256:3EC6A665E7861DC29A393D00EAA00989112E85C6F1B9643CA6C39578AD772084
                          SHA-512:A88E78258F7DB4AECD02F164E6A3AFCF39788E30202CF596F9858092027DDB2FDB66D751013A7ABA5201BFAFF9F2D552D345AFE21C8E1D1425ABBC606028C2E6
                          Malicious:false
                          Preview:7z..'....O; ........2.......D.X..Z.2..7nf..R..s# s..v.f.....%G..>..9..Jh.-j.r..q.2.=v..Q.....SW7....im..|.c...&...,.s....f.h...C.g~..f.7=9...,...sd....iD......cR.^...$..<....nd...S.O..E)0..SQ.AA.C..$.D.|. a.:..5.....b.....2......W.....Z.pS.b/.F.;|`...O/....@.......4.".b.(...4...,..h/.K$..r!...."..`.S...D?.":...n..f.{C..t..,/.S.0.N..M...v...(.Yn..-.)..-...N~....}..).. .j!...1H.7?R..X.....rKi....9.i[k..+.....Br\.=.k.t8...6Lmh.../.V^K.f.......*.@MM..`...,W.......E..v.H....0.W..~....I.....w....<....X.Azl.FH..6\.a..E?=..I.q.5...s...;.,J.0..J.../.w..,..n.EkN..,j....f.y&q.C}fnY..2\......0.....N!.J..H.H0.....BJ.Q..v}=......^c.'w..#...d.T1....#...2s}N.....2.%.?. ....l.).....a<5Y.s....}...2*.#s..]0h..._G....3].....7y.}.B.6...ywE....'q.....h..?p .#..Emm2..F..| .M.Rv!.v.G....1L.Kx...T...".a6.%S0..g..7.......J.vjO.{.A....B@.c.y>}.....N.+....:.L=[....._.....Y.{....F..|.w.oX..t&[.....a\.M..2.Qe.[}L.Ch[...G.S#.$9...8<..W.d1...*PH.`.....4.A.......?..g.

                          C:\Program Files (x86)\Windows NT\locale3.bin

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):31890
                          Entropy (8bit):7.99402458740637
                          Encrypted:true
                          SSDEEP:768:rzwmoD5r754TWCxhazPt9GNgRYpSj3PsQ4yVb595nQ/:vwmolXaT9abVzP1TC
                          MD5:8622FC7228777F64A47BD6C61478ADD9
                          SHA1:9A7C15F341835F83C96DA804DC1E21FDA696BB56
                          SHA-256:4E5C193D58B43630E16B6E86C7E4382B26C9A812D6D28905DD39BC7155FEBEE1
                          SHA-512:71F31079B6C3CE72BC7238560B2CBD012A0285B6A5AC162B18EAE61A059DD3B8DBCF465225E1FB099A1E23ED7BDDF0AAE4ED7C337A10DC20E0FEEC4BC73C5441
                          Malicious:false
                          Preview:.@S......................xi.\ .~.#..:}..fy?koGL^|kH.G...........x....Tg.Y.t....~^..".L.41.....R..|.....R...C.m(.M&...q.v.$..i..U.....).PY.......O.....~..p.u.Y.......{...5^q.|a.]..@DP".`Rz}...|N.uSW.......^..o...U..z...3...bH........p.......Y`..b.t.x.F^i.<.%.r.o..?w.Z..M.fI.!.a...Zsb.+.y..W...n.....;...........|.{.@Q.....#".M...4.A).#;..r...>E..]w{.-....B...........v..`...S...sY....h.Sa)...r.3.U;n8wXq.x...@^z...%8H.Zd._..f~.....u[..q$..%......C..../].rS.....".=..<o.<S....-^"..iIX..r...D.......k.P.e...U..n.]^p..pal....E.c..+..Gc..U?s.R...p...:>..v..o2..B.Hn..q...F..3.o...%.......C......*.V..|..2.J..i.r....|;T.C6).......a..~"K....Y.....]3.{{..N...X>.1.....:?....,..T+=s...............so.;....&....Q.\K..b............k,..#l...Yb...VE.g.3v.$'.H3......w.....{f..e.....PS.tQ..*.8a....5w....\8%..c.;......q.j.t0/.8s..(9....... .S...0.o.o......f*..]....U..>N....Kc/..ka.I"O-O.!./..S".IN .....%G...........x%..ZL`Sq.;.}w.`..k.....F.........Tp..}..?t..

                          C:\Program Files (x86)\Windows NT\locale3.dat

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:7-zip archive data, version 0.4
                          Category:dropped
                          Size (bytes):31890
                          Entropy (8bit):7.99402458740637
                          Encrypted:true
                          SSDEEP:768:jh43RfBLJT55mgLMoqX3gX/i69sXCuWegxJr8qF88M:qhj+I7qCKNSegPnFM
                          MD5:CE6034AFC63BB42F4E0D6CD897DFBCB8
                          SHA1:49E6E67EB36FE2CCAA42234A1DBB17AA2B1C7CC0
                          SHA-256:7B7EB1D44ED88E7C19A19CEDAA25855F6800B87EC7E76873F3EA4D6A65DAA25F
                          SHA-512:7801FA33C19D6504FF2D84453F4BB810FD579CB0C8772871F7CC53E90B835114D0221224A1743C0F5AAE76C658807CC9B4EC3BEC2CAD4AB8C3FD03203DAA7CF0
                          Malicious:false
                          Preview:7z..'....oYU@|......2.........Z....f..t.#.............tb.7E..Jo.........b.I=.Y..6(..=....^..>i.^E.."q.$&8....N...p+.p. .P.z6.b,.8kdD......'...G.R.n.&5..C..H.E..So!T^n{.a#d....z.SB........Nb.........LO+B ...iV..HH.Cc*.o@|.....Yvxb^.cW....._.........m.}.(V.i.H$....R....`.M.p......A?....._..nb..D.*RT<bUV.n].....LD.qU.....U9....]...h..y!...I....&C......g`...YahZ.q4.{.....2ZRG..f.. .M....:t .........8..Eg.....o.....h.]{..........p...M...lh.@.(R.]!B.:...b78$...b.......hc...C~....I..B<.x_OB|...<. .=NZ.....z........sjJ.....*{<..L.......^...9..^d..$d..}......#.dL'~.}....M...j.(5..@.tcVm.H..-.n...D..&....<..Z...@]./7?...[..qfW..!...v...==..d..M..om~).....C..9....c<..WUV.ed.h...]....OCt(X.H<<:.9..{5j....Nh.L.$..>..D..haP..~...............}r=!.E.ng..........9+...2.g.H3Lx.Bu....]jC...q.g.g.U.4..<........)....oo.T.c_.......X.,.@...nu......D.B(~.5....x5...............4S7B..p...Uk.0-m.VM.M@.V\.o...(......".k..w....Z.([.@.MQ.i9..."W..m...N.,.

                          C:\Program Files (x86)\Windows NT\locale4.bin

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):74960
                          Entropy (8bit):7.99759370165655
                          Encrypted:true
                          SSDEEP:1536:x2PlxAOr0Y07RqyjjkFThaVNwDsKsNFBrFYek36pX4MDVuPFOnfIId+:QAOrf07RHjkFThaVGMLF3hNDcPFOn5s
                          MD5:950338D50B95A25F494EE74E97B7B7A9
                          SHA1:F56A5D6C40BC47869A6AE3BC5217D50EA3FC1643
                          SHA-256:87A341B968B325090EF90DFB6D130ED0A1550A1EBDE65B1002E401F1F640854A
                          SHA-512:9A6CC00276564DDE23D4CABA133223D31D9DDD06D8C5B398F234D5CE03774ED7B9C7D875543E945A5B3DB2851EC21332FE429A56744A9CC2157436400793FF83
                          Malicious:false
                          Preview:.@S........................F.T....r...z'I.N..].u.e.e..y.....<|r.:v.....J.i...L.Sv.....Nz..,..K.sI*./.d.p.'.R.....6eF....W{."J.Nt'.{E....mU_..qc.G..M..y.QF)..N..W.o.D!.-...A$.....Nc.(...~.5.9'..>...E..>.5n..s..W.A7..../..+..E.....v..^&.....V..H6..j..S`H.qAG.R.i^&....>@SYz.@......q.....\t=.HE...i..".u.Z.(y.m..3.0\..Wq9#.....iH7..TL.U..3,b........L...D..,..t(mS..06...[6.y....0-....f.N7..R......./..z.bEQ.r..n.CmB'..@......(...l..=.s........`.6.?..[mzl....K.5"..#*.>.~..._...A.%b..........PnI.T...?R~JL<.$V..-.U..}\..t/F..<..t....y(K..v..6"..'.!.*z.R....EJ0.d<v:.R&......x...2....;Tc..(..dW...7a.)...rq.....{"h.wbB..t)f..qj........~.XR.a/........l./.S......".%?.C.cL._.,k.n'....a./.z...{.]...<......._pFP..d..,......Q...[........3...Kq).rJ..8..I.)o...i'Q..=......(dq(.m../..%=.......r m.X|3.......b.~tA.......%+.T..E@..ce...%....,..x#...,....-....A...q.....r.+...?......L..%.c.... ..>.Iw......P...O)...$`.'..D1.r.....*..9;..R...VL.]..%j.....TM.4.....P.L...

                          C:\Program Files (x86)\Windows NT\locale4.dat

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:7-zip archive data, version 0.4
                          Category:dropped
                          Size (bytes):74960
                          Entropy (8bit):7.997593701656546
                          Encrypted:true
                          SSDEEP:1536:xsn0ayGU0SfvuEykcv5ZUi4Q9POZBgfmWRDOs2XwV1NN4+8wbr82nR+2R:xY0ntfvwkcv5ZwYPCBgfmW/VDS+FbrLN
                          MD5:059BA7C31F3E227356CA5F29E4AA2508
                          SHA1:FA3DC96A3336903ED5E6105A197A02E618E3F634
                          SHA-256:1CBF36AFC14ECC78E133EBEC8A6EE1C93DEA85EEC472CE0FB0B57D3E093F08CC
                          SHA-512:E2732D3E092B0A7507653A4743E1FE7A1010A20D4973C209BA7C0B2B79F02DF3CFDB4D7CE1CBFB62AA0C3D2CDE468FC2C78558DA4FF871660355E71DC77D8219
                          Malicious:false
                          Preview:7z..'....G8{p$......@..........0..$D.#'7..^..G.....W.K^.IC;.k...)_...S...2..x.....?(..Rj.g.......B...C..NK.B0s..L?.$..].....$r..E.]~...~K..E..3.......t..k..J......B...4.?!..6r.Qqc.5.r...\..,A.JF.J...Vb..b...M.=^.K7..e..]...X.%^3T...D.y..e2..>...k...\...S.C....')......hhV..K...z4..$d....a[.....6.&.D.:.=^.8.M[....n..i[....]..Y.4...NpkjU..;..W5.#.p.8?u....!.......u.[?.$..^.}f.A..G.N...b7.*...!!.(.....Gc..........Dg....Z.*.#.\".e.m.).t.5..r...6"....Q......fx..W......k..K7^."C.4*Z.{.^WG.....Z..P......Z....7R.....5hy...s....b.....7.V.....k.=.y.i.i......Y.......FY$.|T.5..V...E|...q.........].}bl...y.....;...q....-a..RP3..L~k....|..p_......."......rJz."..v......Z....l1.O.N...Di...O.:m.X...W.......x..}..>ktk.,.~...n-.m..`...G......$.....].lPx..<..9.m4.n...d....G...{'.a........u).R.+.....y.`.p...1@..!..b...J.W..Vt,......h...k....W.,..@Sd.<ZG......}&.R.]p(Y...o...r.4m:.J`.U..S5.iN...^!Y..hHP.B.58....JvB.K.k;...4........\.6=&erz..2..&...Z.C...h_.

                          C:\Program Files (x86)\Windows NT\locale7.bin

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):29730
                          Entropy (8bit):7.994290657653607
                          Encrypted:true
                          SSDEEP:768:e7fyvDZi63BuPi2zBBMqUp6fJzwyQb91SPlssLK4:AfKNiG/2vMx6fJzwVb2tss7
                          MD5:2C3E0D1FB580A8F0855355CC7D8D4F7A
                          SHA1:177E4A0B7C4BC8ACE0F46127398808E669222515
                          SHA-256:9818FEBDE34D7E9900EB1C7A32983CA60C676BE941E2BC1ED9FBD5A187C6F544
                          SHA-512:B9410FC8F5BE02130D50E7389F9A334DD2F2A47694E88FBB9FB4561BD3296F894369B279546EEBB376452DF795C39D87A67C6EE84C362F47FA19CF4C79E5574E
                          Malicious:false
                          Preview:.@S....*z.p,..................kcn..a.^.<..=......7`....6..!`...W.,2u...K.r.1.......1...g<wkw.....q..VfaR...n.h.0b[.h.V$..7.7'd.....T.....`.....)k.....}..........bW'.t..@*.%e5....#.6.g.R.......,W....._..G.d...1..e/...e7....E.....b....#Z,#...@.J.j?....q.ZR.c.b.V....Y-.......3..&E...a.2vg$..z...M9.[......_.1U....A...L.0+3U.[)8...D........5......[..-.u...ib...[..I-....#|j..d..D.S.'.....J.`.....b..y...Iu.D.....2.r}.4....<K.%....0X..X[5.sD...Xh.(G...Z;.."..o..%.......,.y..\..M6.+,.]c..t.:.|...p%.../1%.{>..r..B..yA.......}.`.#.X....Rl`.6\~k.P8..C....V\^..2.7...... h. .>....}..u)..4..w..............^N...@.v....d.P...........IA.. G?..YJ>._La..Y.@.8N.a...BK.....x.T....u.....\x.t...~.2p.M..+.R&w.......7c!v.@..RGf.F.>^+.b=........@l.T5.:........#}.%>.-.C.[XR.TG.\..'....MH..x..Y...cL........y.>....%...:.S.W^..k.EE.5O`.6<5-kh_...."95..:p....P.jk`....b.7.Z.8Y....H(j2y..`d.q;RyZ.5$..3.;......0,......+O.....L.,..u.s....S.1o.g...l"..e.....Cy<....I.+..B@......~.0...<.

                          C:\Program Files (x86)\Windows NT\locale7.dat

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:7-zip archive data, version 0.4
                          Category:dropped
                          Size (bytes):29730
                          Entropy (8bit):7.994290657653608
                          Encrypted:true
                          SSDEEP:768:0AnbQm4/4qQyDC44LY4VfQ8aN/DObt1dSt3OUqZNKME:0ab6c4oY0aBDObjot+Uqu7
                          MD5:A9C8A3E00692F79E1BA9693003F85D18
                          SHA1:5ED62E15A8AC5D49FD29EF2A8DC05D24B2E0FC1F
                          SHA-256:B88E3170EC6660651AF1606375F033F42D3680E4365863675D0E81866E086CC3
                          SHA-512:8354B80622A9808606F1751A53F865C341FF2CE1581B489B50B1181DAA9B2C0A919F94137F47898A4529ECCCD96C43FCCD30BCDF6220FA4017235053AF0B477D
                          Malicious:false
                          Preview:7z..'....G..s......2......../.....h..f...H=...v.:..Q.I..OP.....p..qfX.M.J..).9;...sp......ns./..;w....3.<..m..M.L...k..L..h[-Dnt.*'5....M(w%...HVL..F&......a...R.........SF.2....m@X&X5.!....ER......]xm.....\.....=.q.I.}v.l#.B........:.e....b6.l.d..O......H.C..$.',.B..Q\..\.B.%...g...3?.....*.XuE.J.6`.../...W.../......b..HL?...E.V[...^.~.&..I,..xUH..2V..H..$..;.....c.6.o........g.}.u:.X....9...|Ynic.*.....ooK..>..M~yb..0W....^..J(S......Q?...#.i.1..#.._.9..2E.S7c.....{..'...j.A.p......dS]......i.!..YS...%.Q<..\.0.....FNw....e...2...$..$4..Pv.R...mv...-.b.T.)..r*..!..).n4.+.l[.N...4qN....w.B..[......<U.etA.A....SB..^y.......^0.f._.&..Z.zV.%.R.f_dz.,E..JJ..%.R.7.3m.:..;.`...AoHLHC..|..)f...C....$...E....H"x..F....wW...3"......Y.*Y.....5....,E...tn.KS...2......w\Z..1.".O.=+..A...2.....A.........k. c..../2..i!q..q...u.'.m.6.j.\.....x...S....$....*.&(.).^..f.d.g"j..#^....W.]{.C.?2Z.'X...5.._@..q.j..Xb...n{1..<.i...'r...7'.F.L\(.8

                          C:\Program Files (x86)\Windows NT\res.dat

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:7-zip archive data, version 0.4
                          Category:dropped
                          Size (bytes):2603681
                          Entropy (8bit):7.999925048660142
                          Encrypted:true
                          SSDEEP:49152:LTl/YfOFTVDpw1I8zwTR8K4jZ4O2WLHPyoSnxD14cI7jnyODI6MXpqg4fy:LFyd6RC4+OoGU7jyO7MXQg4fy
                          MD5:58D8EBB349687B1D6069F6413C7E0391
                          SHA1:4D235DCCE39C99DD182D660964CE1EBA66427B06
                          SHA-256:5D181A626C632CFDAA81340AC6AC005EBA31A35BF69C7977D202E7F8F29D29AE
                          SHA-512:D421B3365A60FA10681B55BFEE5AC3C390EE48BFA4ACA1FF853A468FF6E64BF25FD837D7D93139AD3FF43C25DA21EADE791C6FE0B18D762D9D7D1FC06C0635C8
                          Malicious:false
                          Preview:7z..'.......@.'.....A........q._t.....5oO./`..`.6C.+.*......2y@.B....Ni@..l;.).Uc....w.....I4..CfW'.G.|1.I?..]..>%Ue.(.DX..?...[..q8.I3.n.8.'Up..(......~R. c........U.3i.s...*.3]........c..............LO....Ax.P..S..6o.E....r.p.&c......p.d..`.......y3..0...m(.G$"hNfR...y.I..S.j..{O..d<._.^.X.....{..+.#.@....s.]t.Nx......WWlJ.......=%i7jS..&.S..R.....Z.A...Kdb...w.#o....N....\...@.wy...+..A...S..r?...w..[........:..a..W%.~}:....;..Y..lA.../(9x......e.2......4S..W.o..Z.'....&N..I..f..{.._j|5.B.....W-..............O.-.x..T.Q.sS.5x.v.p....k]bMG!.+......;.....\!....9..S.Q.?).RM.....>. ..k.\,b.<,+.L...v.....p..J....c.....r......9..........S...........n...1~..6........r.x;.......g.g..b.Z@.."..+..u...P...oE...r.m....c.e.P...1...2.v......1\+-.../.I1..M..Y..K..~.%.......&e..(.....r....4PJ.i+.D..@..Q.%.(.....s.$..S...,.=.L.e..K...2.$.6..C....=BJ.O....q..O#...;....N.7e..(...,BJ..E.......6.h....u.Jg@.k..|..$Qf.2.L...A.h.I]...[.... _o7ID.R...-. .)C.$..21...v...>..

                          C:\Program Files (x86)\Windows NT\tProtect.dll

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:PE32+ executable (native) x86-64, for MS Windows
                          Category:dropped
                          Size (bytes):63640
                          Entropy (8bit):6.482810107683822
                          Encrypted:false
                          SSDEEP:768:4l2NchwQqrK3SBq3Xf2Zm+Oo1acHyKWkm9loSZVHT4yy5FPSFlWd/Ce34nqciC50:kgrFq3OVgUgla/4nqy5K2/zW
                          MD5:B4EAACCE30F51EAF2A36CEA680B45A66
                          SHA1:94493D7739C5EE7346DA31D9523404D62682B195
                          SHA-256:15E84D040C2756B2D1B6C3F99D5A1079DC8854844D3C24D740FAFD8C668E5FB9
                          SHA-512:16F46ABE2DD8C1A95705C397B0A5A0BC589383B60FE7C4F25503781D47160C0D68CBA0113BA918747115EF27A48AB7CA7F56CC55920F097313A2DA73343DF10B
                          Malicious:false
                          Antivirus:
                          • Antivirus: ReversingLabs, Detection: 9%
                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.[.7.5N7.5N7.5N7.4NX.5NA'NN4.5NA'HN5.5N.|XN4.5N.|HN6.5NA'XN6.5N.|DN0.5N.|IN6.5N.|MN6.5NRich7.5N........................PE..d....(gK..........".........."............................................... ..............................................................d...(........................(.......... ................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..0...........................@..B................................................................................................................................................................................................................

                          C:\Program Files (x86)\Windows NT\task.xml

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:data
                          Category:dropped
                          Size (bytes):4096
                          Entropy (8bit):3.3449406240731085
                          Encrypted:false
                          SSDEEP:48:dXKLzDlnDPLL6w0QldOVQOj933ODOiTdKbKsz72eW+5y4:dXazDlnDP6whldOVQOj6dKbKsz7
                          MD5:1EA10B1FA76DC2F1967E53A3FC2D43C4
                          SHA1:23EADA9D0994D5B9ADE7878493C44551C0B5CF44
                          SHA-256:2748447EBDE83E35B8984D2993A8331DAC7B7924638502024D8531A07E74C63C
                          SHA-512:15BF2663CEF3905AE3B13D0A4ABC2E3BBF1FF213BCA5C568641978D5548A7DBED2EC7FC5A00B330287E90DF675EFB804613D4801F6995C7748840CC0BCBA637F
                          Malicious:false
                          Preview:<Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2005-10-11T13:21:17-08:00</Date>. <Author>Microsoft Corporation</Author>. <Version>1.0.0</Version>. <Description>Microsoft</Description>. <URI>\kafanbbs</URI>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user</UserId>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="System">. <UserId>user</UserId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAv

                          C:\Program Files (x86)\Windows NT\trash

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:OpenPGP Secret Key
                          Category:dropped
                          Size (bytes):2353553
                          Entropy (8bit):7.99992611421159
                          Encrypted:true
                          SSDEEP:49152:rtfmdyArF7jC2uzD04c4vtHlkTmMVDfFv3ARw3ieIXzFj0nHfh:roDrBKxxlkq0fNAW3ieIXzuZ
                          MD5:73616E6FB705D7163A2D8A391DDCAD6C
                          SHA1:2ADEE96903C346D920E7B7B7527BE089F8388D87
                          SHA-256:4AE1FF98AEC7817FF9E35A15118CFBD61CCF00C766ABE08C4EEFB58889EDF04E
                          SHA-512:74D4726E6593783D062AFB2703C1B6465019C247DD2468B657AD95413BC4A3707F9D2695D9BE3CA51C9590A28C3ED22DDC52615F10F742A4432CD3A72A3A18FD
                          Malicious:false
                          Preview:....;.3......v.D.8.Wg..y.v.....u....Bwa...]`t...~..-..n.........9l..v.I}gwwT..7H.t?..6.G.x.-'7....]$...iq~....J`........$...(..m.z....,y..2C7.?...O...D.._..dP.&;....n .....a..l...#R......K.[&.eb.\&B..M..d .[.<.t\..W..,$........;@..........?.x..$+..Z...:.f....i.WL'..g .Xv1V....[f..._........+'.T.9..%...../v_)...G0........`(.J1+....U.l.9..2........Y..._K.....z.-......$..@E..c.J..c....B....h.;.5..2*I7>....e.L...R..M.0"jz'.....g......:...A.?s...]C3?.%.....;.."..1........\Q...d+..Z...:-..M.Q.o.P...Y...`%O..I.f?.Kb...2./'].?Qq....+f..)..g*["9.0.S..T+A...Z..v....Y...uR(.....3....&kD....D.+..v......Of,.D....Vz.9.9jZ.d...f...c..m.[Y....|5.jV.....Oq...5.t|.. N.P..~...a...5.......3.<++'...=..<.....l..!_.o9L.:..y..g.T.\...H.@....../t..<L.F.q1..B.!.9+|.s}e4.j*Zbg_W..t..{.&xY.q.8.=M...8.O..x..._]6h%....g.....~.O..........$..p.~!.E[.*!.+b.EH.......)..2.).KH.....(p...%u......!.t\+.....R. .$.ir...m.L+IC...OD....:26..y.j.x<L.?u.R.........x...........[.

                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Download File
                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):64
                          Entropy (8bit):1.1940658735648508
                          Encrypted:false
                          SSDEEP:3:NlllulFuPh:NllUUP
                          MD5:CC47C65E9D7FF52BEBF356F8F22FCCF9
                          SHA1:25AC4580D6C84DB6F2675161368A5B89A48AB692
                          SHA-256:CB1B97C689468D47FCDB7116ACBBEE0A8AC183F9C27517ABC376E57EC666C8D3
                          SHA-512:882F88AF5A2C636C9949E24056105407E8C007643B49452EED7397B338AAC859B457F72901900A545B5474258CA15411158CEF34ABB512494C188843349AE601
                          Malicious:false
                          Preview:@...e.................................T.:............@..........

                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jinjejp.ss3.psm1

                          Download File
                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):60
                          Entropy (8bit):4.038920595031593
                          Encrypted:false
                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                          Malicious:false
                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ex0utvpt.ow1.psm1

                          Download File
                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):60
                          Entropy (8bit):4.038920595031593
                          Encrypted:false
                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                          Malicious:false
                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hko5pinr.ebv.ps1

                          Download File
                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):60
                          Entropy (8bit):4.038920595031593
                          Encrypted:false
                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                          Malicious:false
                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysfgwhqr.stk.ps1

                          Download File
                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):60
                          Entropy (8bit):4.038920595031593
                          Encrypted:false
                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                          Malicious:false
                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                          C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp

                          Download File
                          Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe
                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):3366912
                          Entropy (8bit):6.530564726182663
                          Encrypted:false
                          SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                          MD5:F0D4EEA505CEB561AB4AD622E3C0B9D5
                          SHA1:70CB1C9B1E2A3B544A587225AB9D8AADB7B72395
                          SHA-256:1881A519E644331856A6B867FC1827BB2AFF3D7D3046CB745E1A73934354C539
                          SHA-512:0FAC2790242C0D65F541B0EBA14C411E505CC0C50166A289E478525C56FA845C6AF115E51993C3739358367DE3C47E1044A9CC4237F8149A8ABD637F30269058
                          Malicious:true
                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                          C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp

                          Download File
                          Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe
                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):3366912
                          Entropy (8bit):6.530564726182663
                          Encrypted:false
                          SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                          MD5:F0D4EEA505CEB561AB4AD622E3C0B9D5
                          SHA1:70CB1C9B1E2A3B544A587225AB9D8AADB7B72395
                          SHA-256:1881A519E644331856A6B867FC1827BB2AFF3D7D3046CB745E1A73934354C539
                          SHA-512:0FAC2790242C0D65F541B0EBA14C411E505CC0C50166A289E478525C56FA845C6AF115E51993C3739358367DE3C47E1044A9CC4237F8149A8ABD637F30269058
                          Malicious:true
                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                          C:\Users\user\AppData\Local\Temp\is-L8408.tmp\_isetup\_setup64.tmp

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:PE32+ executable (console) x86-64, for MS Windows
                          Category:dropped
                          Size (bytes):6144
                          Entropy (8bit):4.720366600008286
                          Encrypted:false
                          SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                          MD5:E4211D6D009757C078A9FAC7FF4F03D4
                          SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                          SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                          SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                          Malicious:false
                          Antivirus:
                          • Antivirus: ReversingLabs, Detection: 0%
                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Temp\is-L8408.tmp\update.vac

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):3606528
                          Entropy (8bit):7.005604268954487
                          Encrypted:false
                          SSDEEP:98304:yLVLAJG42oakQdhme71MzSRTP/Se7NHaV:yZyTFaOe71MzSP/Se75g
                          MD5:1047AF726D2E233D71934EF55E635C4A
                          SHA1:AB12E827E4E57DEA2E885733F0C48E9A83756678
                          SHA-256:42934349F3C8D0EE1CD121B8386A5A6D28D7E8E54A251AE18AA0992D5897EC44
                          SHA-512:8A26268641B1B3F54ABE04CA2212FCA8BCCBD575DCDAB38F7E921FE9E01C29B99BCE25913642E658027A47E27AED795DD5FF3EF9DDC1077108BE29210052AF7E
                          Malicious:false
                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....gg...........!.....b..........%.........................................7...........@.........................HC.......J..<....07.X....................@7.$?..........................x........................K...............................text...`a.......b.................. ..`.rdata..<............f..............@..@.data................\..............@....00cfg.......`(.......(.............@..@.tls.........p(.......(.............@....voltbl.F.....(...... (..................8Tk....p.....(......"(............. ..`.rsrc...X....07.......6.............@..@.reloc..$?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\_isetup\_setup64.tmp

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:PE32+ executable (console) x86-64, for MS Windows
                          Category:dropped
                          Size (bytes):6144
                          Entropy (8bit):4.720366600008286
                          Encrypted:false
                          SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                          MD5:E4211D6D009757C078A9FAC7FF4F03D4
                          SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                          SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                          SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                          Malicious:false
                          Antivirus:
                          • Antivirus: ReversingLabs, Detection: 0%
                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Temp\is-SN9SA.tmp\update.vac

                          Download File
                          Process:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):3606528
                          Entropy (8bit):7.005604268954487
                          Encrypted:false
                          SSDEEP:98304:yLVLAJG42oakQdhme71MzSRTP/Se7NHaV:yZyTFaOe71MzSP/Se75g
                          MD5:1047AF726D2E233D71934EF55E635C4A
                          SHA1:AB12E827E4E57DEA2E885733F0C48E9A83756678
                          SHA-256:42934349F3C8D0EE1CD121B8386A5A6D28D7E8E54A251AE18AA0992D5897EC44
                          SHA-512:8A26268641B1B3F54ABE04CA2212FCA8BCCBD575DCDAB38F7E921FE9E01C29B99BCE25913642E658027A47E27AED795DD5FF3EF9DDC1077108BE29210052AF7E
                          Malicious:false
                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....gg...........!.....b..........%.........................................7...........@.........................HC.......J..<....07.X....................@7.$?..........................x........................K...............................text...`a.......b.................. ..`.rdata..<............f..............@..@.data................\..............@....00cfg.......`(.......(.............@..@.tls.........p(.......(.............@....voltbl.F.....(...... (..................8Tk....p.....(......"(............. ..`.rsrc...X....07.......6.............@..@.reloc..$?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                          \Device\ConDrv

                          Download File
                          Process:C:\Program Files (x86)\Windows NT\7zr.exe
                          File Type:ASCII text, with CRLF, CR line terminators
                          Category:dropped
                          Size (bytes):406
                          Entropy (8bit):5.117520345541057
                          Encrypted:false
                          SSDEEP:6:AMpUMcvtFHcAxXF2SaioBGWOSTIPAiTVHsCgN/J2+ebVcdsvUGrFfpap1tNSK6n:pCXVZRwXkWDThGHs/JldsvhJA1tNS9n
                          MD5:9200058492BCA8F9D88B4877F842C148
                          SHA1:EED69748A26CFAF769EF589F395A162E87005B36
                          SHA-256:BAFB8C87BCB80E77FF659D7B8152145866D8BD67D202624515721CBF38BA8745
                          SHA-512:312AB0CBA3151B3CE424198C0855EEE39CC06FC8271E3D49134F00D7E09407964F31D3107169479CE4F8FD85D20BBD3F5309D3052849021954CD46A0B723F2A9
                          Malicious:false
                          Preview:..7-Zip (a) 23.01 (x86) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20....Scanning the drive for archives:.. 0M Scan. .1 file, 31890 bytes (32 KiB)....Extracting archive: locale3.dat..--..Path = locale3.dat..Type = 7z..Physical Size = 31890..Headers Size = 354..Method = LZMA2:16 LZMA:16 BCJ2 7zAES..Solid = -..Blocks = 1.... 0%. .Everything is Ok....Size: 63640..Compressed: 31890..

                          Static File Info

                          General

                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                          Entropy (8bit):7.95914765295349
                          TrID:
                          • Win32 Executable (generic) a (10002005/4) 98.04%
                          • Inno Setup installer (109748/4) 1.08%
                          • InstallShield setup (43055/19) 0.42%
                          • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                          • Win16/32 Executable Delphi generic (2074/23) 0.02%
                          File name:#U5b89#U88c5#U52a9#U624b1.0.1.exe
                          File size:8'595'621 bytes
                          MD5:f2845d6410a0d9a090d414f3ae742e3b
                          SHA1:a27e62687254f001c08b5313465d2ed1870f0eb5
                          SHA256:f56c3d038c408355f6fb191865ca5650b29926f65b78d02b008b509bf640e588
                          SHA512:48261d07b5f44f89414ceca11345413f97388e78a5d7f9dd56bf2a4520083150d9fe20ac11160274f457cfadb0b4bfea685135cb1f1ed2da288a488085a738c6
                          SSDEEP:196608:lWLc3zOIl9n+GOdz13XOJqJfWovaeOTX8I0JGZI24j:lWLiqGn+B3X6O+ovEsIm
                          TLSH:2E862213F2CBD43EE45E0B3B15B2A25454FB7A256826AE5386ECB4ECCF250501D3E64B
                          File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                          File Icon

                          Icon Hash:0c0c2d33ceec80aa

                          Static PE Info

                          General

                          Entrypoint:0x4a83bc
                          Entrypoint Section:.itext
                          Digitally signed:false
                          Imagebase:0x400000
                          Subsystem:windows gui
                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                          Time Stamp:0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
                          TLS Callbacks:
                          CLR (.Net) Version:
                          OS Version Major:6
                          OS Version Minor:1
                          File Version Major:6
                          File Version Minor:1
                          Subsystem Version Major:6
                          Subsystem Version Minor:1
                          Import Hash:40ab50289f7ef5fae60801f88d4541fc

                          Entrypoint Preview

                          Instruction
                          push ebp
                          mov ebp, esp
                          add esp, FFFFFFA4h
                          push ebx
                          push esi
                          push edi
                          xor eax, eax
                          mov dword ptr [ebp-3Ch], eax
                          mov dword ptr [ebp-40h], eax
                          mov dword ptr [ebp-5Ch], eax
                          mov dword ptr [ebp-30h], eax
                          mov dword ptr [ebp-38h], eax
                          mov dword ptr [ebp-34h], eax
                          mov dword ptr [ebp-2Ch], eax
                          mov dword ptr [ebp-28h], eax
                          mov dword ptr [ebp-14h], eax
                          mov eax, 004A2EBCh
                          call 00007F25DDB7BA35h
                          xor eax, eax
                          push ebp
                          push 004A8AC1h
                          push dword ptr fs:[eax]
                          mov dword ptr fs:[eax], esp
                          xor edx, edx
                          push ebp
                          push 004A8A7Bh
                          push dword ptr fs:[edx]
                          mov dword ptr fs:[edx], esp
                          mov eax, dword ptr [004B0634h]
                          call 00007F25DDC0D3BBh
                          call 00007F25DDC0CF0Eh
                          lea edx, dword ptr [ebp-14h]
                          xor eax, eax
                          call 00007F25DDC07BE8h
                          mov edx, dword ptr [ebp-14h]
                          mov eax, 004B41F4h
                          call 00007F25DDB75AE3h
                          push 00000002h
                          push 00000000h
                          push 00000001h
                          mov ecx, dword ptr [004B41F4h]
                          mov dl, 01h
                          mov eax, dword ptr [0049CD14h]
                          call 00007F25DDC08F13h
                          mov dword ptr [004B41F8h], eax
                          xor edx, edx
                          push ebp
                          push 004A8A27h
                          push dword ptr fs:[edx]
                          mov dword ptr fs:[edx], esp
                          call 00007F25DDC0D443h
                          mov dword ptr [004B4200h], eax
                          mov eax, dword ptr [004B4200h]
                          cmp dword ptr [eax+0Ch], 01h
                          jne 00007F25DDC1412Ah
                          mov eax, dword ptr [004B4200h]
                          mov edx, 00000028h
                          call 00007F25DDC09808h
                          mov edx, dword ptr [004B4200h]

                          Data Directories

                          NameVirtual AddressVirtual Size Is in Section
                          IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                          IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xcb0000x11000.rsrc
                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xba0000x10fa8.reloc
                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                          IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                          Sections

                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                          .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                          .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                          .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                          .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                          .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                          .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .reloc0xba0000x10fa80x11000a85fda2741bd9417695daa5fc5a9d7a5False0.5789579503676471data6.709466460182023IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                          .rsrc0xcb0000x110000x11000ae78e7ec4c172739526732707a28f0f9False0.187744140625data3.7229388634712897IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                          Resources

                          NameRVASizeTypeLanguageCountryZLIB Complexity
                          RT_ICON0xcb6780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                          RT_ICON0xcc0e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                          RT_ICON0xcc7480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                          RT_ICON0xcca300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                          RT_ICON0xccb580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                          RT_ICON0xce1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                          RT_ICON0xcf0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                          RT_ICON0xcf8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                          RT_ICON0xcfe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                          RT_ICON0xd11200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                          RT_ICON0xd53480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                          RT_ICON0xd78f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                          RT_ICON0xd89980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                          RT_STRING0xd8e000x3f8data0.3198818897637795
                          RT_STRING0xd91f80x2dcdata0.36475409836065575
                          RT_STRING0xd94d40x430data0.40578358208955223
                          RT_STRING0xd99040x44cdata0.38636363636363635
                          RT_STRING0xd9d500x2d4data0.39226519337016574
                          RT_STRING0xda0240xb8data0.6467391304347826
                          RT_STRING0xda0dc0x9cdata0.6410256410256411
                          RT_STRING0xda1780x374data0.4230769230769231
                          RT_STRING0xda4ec0x398data0.3358695652173913
                          RT_STRING0xda8840x368data0.3795871559633027
                          RT_STRING0xdabec0x2a4data0.4275147928994083
                          RT_RCDATA0xdae900x10data1.5
                          RT_RCDATA0xdaea00x310data0.6173469387755102
                          RT_RCDATA0xdb1b00x2cdata1.1818181818181819
                          RT_GROUP_ICON0xdb1dc0xbcdataEnglishUnited States0.6170212765957447
                          RT_VERSION0xdb2980x584dataEnglishUnited States0.2769121813031161
                          RT_MANIFEST0xdb81c0x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                          Imports

                          DLLImport
                          kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                          comctl32.dllInitCommonControls
                          user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                          oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                          advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                          Exports

                          NameOrdinalAddress
                          __dbk_fcall_wrapper20x40fc10
                          dbkFCallWrapperAddr10x4b063c

                          Possible Origin

                          Language of compilation systemCountry where language is spokenMap
                          EnglishUnited States

                          Network Behavior

                          ⊘No network behavior found

                          Statistics

                          CPU Usage

                          Click to jump to process

                          Memory Usage

                          Click to jump to process

                          High Level Behavior Distribution

                          Click to dive into process behavior distribution

                          Behavior

                          Click to jump to process

                          System Behavior

                          General

                          Target ID:0
                          Start time:23:02:15
                          Start date:23/12/2024
                          Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe"
                          Imagebase:0x9e0000
                          File size:8'595'621 bytes
                          MD5 hash:F2845D6410A0D9A090D414F3AE742E3B
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:Borland Delphi
                          Reputation:low
                          Has exited:true

                          General

                          Target ID:1
                          Start time:23:02:16
                          Start date:23/12/2024
                          Path:C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\AppData\Local\Temp\is-2T7ET.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$20444,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe"
                          Imagebase:0xa10000
                          File size:3'366'912 bytes
                          MD5 hash:F0D4EEA505CEB561AB4AD622E3C0B9D5
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:Borland Delphi
                          Reputation:low
                          Has exited:true

                          General

                          Target ID:3
                          Start time:23:02:16
                          Start date:23/12/2024
                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          Wow64 process (32bit):false
                          Commandline:"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
                          Imagebase:0x7ff7be880000
                          File size:452'608 bytes
                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:4
                          Start time:23:02:16
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:5
                          Start time:23:02:24
                          Start date:23/12/2024
                          Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                          Imagebase:0x7ff6ef0c0000
                          File size:496'640 bytes
                          MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                          Has elevated privileges:true
                          Has administrator privileges:false
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:false

                          General

                          Target ID:6
                          Start time:23:02:24
                          Start date:23/12/2024
                          Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENT
                          Imagebase:0x9e0000
                          File size:8'595'621 bytes
                          MD5 hash:F2845D6410A0D9A090D414F3AE742E3B
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:Borland Delphi
                          Reputation:low
                          Has exited:false

                          General

                          Target ID:7
                          Start time:23:02:25
                          Start date:23/12/2024
                          Path:C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\AppData\Local\Temp\is-05V1G.tmp\#U5b89#U88c5#U52a9#U624b1.0.1.tmp" /SL5="$5046E,7641276,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b1.0.1.exe" /VERYSILENT
                          Imagebase:0xac0000
                          File size:3'366'912 bytes
                          MD5 hash:F0D4EEA505CEB561AB4AD622E3C0B9D5
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:Borland Delphi
                          Reputation:low
                          Has exited:true

                          General

                          Target ID:8
                          Start time:23:02:27
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:9
                          Start time:23:02:27
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:10
                          Start time:23:02:27
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:11
                          Start time:23:02:27
                          Start date:23/12/2024
                          Path:C:\Program Files (x86)\Windows NT\7zr.exe
                          Wow64 process (32bit):true
                          Commandline:7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
                          Imagebase:0x180000
                          File size:831'200 bytes
                          MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Antivirus matches:
                          • Detection: 0%, ReversingLabs
                          Has exited:true

                          General

                          Target ID:12
                          Start time:23:02:27
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:13
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Program Files (x86)\Windows NT\7zr.exe
                          Wow64 process (32bit):true
                          Commandline:7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
                          Imagebase:0x180000
                          File size:831'200 bytes
                          MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:14
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:15
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff6d64d0000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:16
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:17
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:18
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:19
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:20
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:21
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:22
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:23
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:24
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:25
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:26
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:27
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:28
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:29
                          Start time:23:02:28
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:30
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:31
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:32
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:33
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:34
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:35
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:36
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:37
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:38
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:39
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:40
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:41
                          Start time:23:02:29
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:42
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:43
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:45
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:46
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:47
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:48
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:49
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:50
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:51
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:52
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:53
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:54
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:55
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:56
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:57
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:58
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:59
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6068e0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:60
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:61
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:62
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:63
                          Start time:23:02:30
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:64
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:65
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:66
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:67
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:68
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:69
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:70
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:71
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:72
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:73
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:74
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:75
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:76
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:77
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:78
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:79
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:80
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:81
                          Start time:23:02:31
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:82
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:83
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:84
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:85
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:86
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:87
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:88
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:89
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:90
                          Start time:23:02:32
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:91
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:92
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:93
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:94
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:95
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:96
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:97
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:98
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:99
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:100
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:101
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:102
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:103
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:104
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\sc.exe
                          Wow64 process (32bit):false
                          Commandline:sc start CleverSoar
                          Imagebase:0x7ff6a59a0000
                          File size:72'192 bytes
                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:105
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6d64d0000
                          File size:862'208 bytes
                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          General

                          Target ID:106
                          Start time:23:02:33
                          Start date:23/12/2024
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd /c start sc start CleverSoar
                          Imagebase:0x7ff674670000
                          File size:289'792 bytes
                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Has exited:true

                          Disassembly

                          Reset < >

                            Execution Graph

                            Execution Coverage:1.6%
                            Dynamic/Decrypted Code Coverage:0%
                            Signature Coverage:15.3%
                            Total number of Nodes:828
                            Total number of Limit Nodes:9
                            execution_graph 100252 6cb23d62 100254 6cb23bc0 100252->100254 100253 6cb23e8a GetCurrentThread NtSetInformationThread 100255 6cb23eea 100253->100255 100254->100253 100256 6cb33b72 100269 6cca6a43 100256->100269 100263 6cb337e0 std::ios_base::_Ios_base_dtor _Yarn _strlen 100266 6cb4639e 100263->100266 100283 6cc9aec0 100263->100283 100289 6cb46ba0 100263->100289 100308 6cb46e60 100263->100308 100318 6cb47090 100263->100318 100331 6cb6e010 100263->100331 100337 6ccb0130 18 API calls 2 library calls 100266->100337 100270 6cca6a48 100269->100270 100271 6cca6a62 100270->100271 100274 6cca6a64 std::_Facet_Register 100270->100274 100338 6ccaf014 EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100270->100338 100271->100263 100273 6cca78c3 std::_Facet_Register 100342 6cca9379 RaiseException 100273->100342 100274->100273 100339 6cca9379 RaiseException 100274->100339 100276 6cca80bc IsProcessorFeaturePresent 100282 6cca80e1 100276->100282 100278 6cca7883 100340 6cca9379 RaiseException 100278->100340 100280 6cca78a3 std::invalid_argument::invalid_argument 100341 6cca9379 RaiseException 100280->100341 100282->100263 100284 6cc9aed4 100283->100284 100285 6cc9aed6 FindFirstFileA 100283->100285 100284->100285 100286 6cc9af10 100285->100286 100287 6cc9af14 FindClose 100286->100287 100288 6cc9af72 100286->100288 100287->100286 100288->100263 100290 6cb46bd5 100289->100290 100343 6cb72020 100290->100343 100292 6cb46c68 100293 6cca6a43 std::_Facet_Register 4 API calls 100292->100293 100294 6cb46ca0 100293->100294 100360 6cca7327 100294->100360 100296 6cb46cb4 100372 6cb71d90 100296->100372 100299 6cb46d8e 100299->100263 100301 6cb46dc8 100380 6cb726e0 24 API calls 4 library calls 100301->100380 100303 6cb46dda 100381 6cca9379 RaiseException 100303->100381 100305 6cb46def 100306 6cb6e010 67 API calls 100305->100306 100307 6cb46e0f 100306->100307 100307->100263 100309 6cb46e9f 100308->100309 100312 6cb46eb3 100309->100312 100776 6cb73560 32 API calls std::_Xinvalid_argument 100309->100776 100314 6cb46f5b 100312->100314 100778 6cb72250 30 API calls 100312->100778 100779 6cb726e0 24 API calls 4 library calls 100312->100779 100780 6cca9379 RaiseException 100312->100780 100315 6cb46f6e 100314->100315 100777 6cb737e0 32 API calls std::_Xinvalid_argument 100314->100777 100315->100263 100319 6cb4709e 100318->100319 100322 6cb470d1 100318->100322 100781 6cb701f0 100319->100781 100320 6cb47183 100320->100263 100322->100320 100785 6cb72250 30 API calls 100322->100785 100325 6ccb0b18 67 API calls 100325->100322 100326 6cb471ae 100786 6cb72340 24 API calls 100326->100786 100328 6cb471be 100787 6cca9379 RaiseException 100328->100787 100330 6cb471c9 100332 6cb6e04b 100331->100332 100333 6cb6e0a3 100332->100333 100334 6cb701f0 64 API calls 100332->100334 100333->100263 100335 6cb6e098 100334->100335 100336 6ccb0b18 67 API calls 100335->100336 100336->100333 100338->100270 100339->100278 100340->100280 100341->100273 100342->100276 100344 6cca6a43 std::_Facet_Register 4 API calls 100343->100344 100345 6cb7207e 100344->100345 100346 6cca7327 43 API calls 100345->100346 100347 6cb72092 100346->100347 100382 6cb72f60 42 API calls 4 library calls 100347->100382 100349 6cb7210d 100352 6cb72120 100349->100352 100383 6cca6f8e 9 API calls 2 library calls 100349->100383 100350 6cb720c8 100350->100349 100351 6cb72136 100350->100351 100384 6cb72250 30 API calls 100351->100384 100352->100292 100355 6cb7215b 100385 6cb72340 24 API calls 100355->100385 100357 6cb72171 100386 6cca9379 RaiseException 100357->100386 100359 6cb7217c 100359->100292 100361 6cca7333 __EH_prolog3 100360->100361 100387 6cca6eb5 100361->100387 100365 6cca736f 100393 6cca6ee6 100365->100393 100367 6cca7351 100401 6cca73ba 39 API calls std::locale::_Setgloballocale 100367->100401 100369 6cca73ac 100369->100296 100370 6cca7359 100402 6cca71b1 HeapFree GetLastError _Yarn 100370->100402 100373 6cb46d5d 100372->100373 100374 6cb71ddc 100372->100374 100373->100299 100379 6cb72250 30 API calls 100373->100379 100407 6cca7447 100374->100407 100378 6cb71e82 100379->100301 100380->100303 100381->100305 100382->100350 100383->100352 100384->100355 100385->100357 100386->100359 100388 6cca6ecb 100387->100388 100389 6cca6ec4 100387->100389 100391 6cca6ec9 100388->100391 100404 6cca858b EnterCriticalSection 100388->100404 100403 6ccb03cd 6 API calls std::_Lockit::_Lockit 100389->100403 100391->100365 100400 6cca7230 6 API calls 2 library calls 100391->100400 100394 6ccb03db 100393->100394 100395 6cca6ef0 100393->100395 100406 6ccb03b6 LeaveCriticalSection 100394->100406 100396 6cca6f03 100395->100396 100405 6cca8599 LeaveCriticalSection 100395->100405 100396->100369 100399 6ccb03e2 100399->100369 100400->100367 100401->100370 100402->100365 100403->100391 100404->100391 100405->100396 100406->100399 100408 6cca7450 100407->100408 100411 6cb71dea 100408->100411 100416 6ccafd4a 100408->100416 100410 6cca749c 100410->100411 100427 6ccafa58 65 API calls 100410->100427 100411->100373 100415 6ccac563 18 API calls __fassign 100411->100415 100413 6cca74b7 100413->100411 100428 6ccb0b18 100413->100428 100415->100378 100418 6ccafd55 __wsopen_s 100416->100418 100417 6ccafd68 100453 6ccb0120 18 API calls __fassign 100417->100453 100418->100417 100419 6ccafd88 100418->100419 100423 6ccafd78 100419->100423 100439 6ccbae0c 100419->100439 100423->100410 100427->100413 100429 6ccb0b24 __wsopen_s 100428->100429 100430 6ccb0b43 100429->100430 100431 6ccb0b2e 100429->100431 100436 6ccb0b3e 100430->100436 100634 6ccac5a9 EnterCriticalSection 100430->100634 100649 6ccb0120 18 API calls __fassign 100431->100649 100434 6ccb0b60 100635 6ccb0b9c 100434->100635 100436->100411 100437 6ccb0b6b 100650 6ccb0b92 LeaveCriticalSection 100437->100650 100440 6ccbae18 __wsopen_s 100439->100440 100455 6ccb039f EnterCriticalSection 100440->100455 100442 6ccbae26 100456 6ccbaeb0 100442->100456 100447 6ccbaf72 100448 6ccbb091 100447->100448 100480 6ccbb114 100448->100480 100451 6ccafdcc 100454 6ccafdf5 LeaveCriticalSection 100451->100454 100453->100423 100454->100423 100455->100442 100457 6ccbaed3 100456->100457 100458 6ccbaf2b 100457->100458 100465 6ccbae33 100457->100465 100473 6ccac5a9 EnterCriticalSection 100457->100473 100474 6ccac5bd LeaveCriticalSection 100457->100474 100475 6ccb71e5 EnterCriticalSection LeaveCriticalSection HeapAlloc __Getctype std::_Facet_Register 100458->100475 100460 6ccbaf34 100476 6ccb47bb HeapFree GetLastError _free 100460->100476 100463 6ccbaf3d 100463->100465 100477 6ccb6c1f 6 API calls std::_Lockit::_Lockit 100463->100477 100470 6ccbae6c 100465->100470 100466 6ccbaf5c 100478 6ccac5a9 EnterCriticalSection 100466->100478 100469 6ccbaf6f 100469->100465 100479 6ccb03b6 LeaveCriticalSection 100470->100479 100472 6ccafda3 100472->100423 100472->100447 100473->100457 100474->100457 100475->100460 100476->100463 100477->100466 100478->100469 100479->100472 100481 6ccbb133 100480->100481 100482 6ccbb146 100481->100482 100486 6ccbb15b 100481->100486 100496 6ccb0120 18 API calls __fassign 100482->100496 100484 6ccbb0a7 100484->100451 100493 6ccc3fde 100484->100493 100489 6ccbb27b 100486->100489 100497 6ccc3ea8 37 API calls __fassign 100486->100497 100488 6ccbb2cb 100488->100489 100498 6ccc3ea8 37 API calls __fassign 100488->100498 100489->100484 100500 6ccb0120 18 API calls __fassign 100489->100500 100491 6ccbb2e9 100491->100489 100499 6ccc3ea8 37 API calls __fassign 100491->100499 100501 6ccc4396 100493->100501 100496->100484 100497->100488 100498->100491 100499->100489 100500->100484 100502 6ccc43a2 __wsopen_s 100501->100502 100503 6ccc43a9 100502->100503 100504 6ccc43d4 100502->100504 100519 6ccb0120 18 API calls __fassign 100503->100519 100510 6ccc3ffe 100504->100510 100509 6ccc3ff9 100509->100451 100521 6ccb06cb 100510->100521 100515 6ccc4034 100517 6ccc4066 100515->100517 100561 6ccb47bb HeapFree GetLastError _free 100515->100561 100520 6ccc442b LeaveCriticalSection __wsopen_s 100517->100520 100519->100509 100520->100509 100562 6ccabceb 100521->100562 100524 6ccb06ef 100526 6ccabdf6 100524->100526 100571 6ccabe4e 100526->100571 100528 6ccabe0e 100528->100515 100529 6ccc406c 100528->100529 100586 6ccc44ec 100529->100586 100535 6ccc4192 GetFileType 100538 6ccc419d GetLastError 100535->100538 100539 6ccc41e4 100535->100539 100536 6ccc409e __dosmaperr 100536->100515 100537 6ccc4167 GetLastError 100537->100536 100615 6ccaf9f2 __dosmaperr _free 100538->100615 100616 6ccc17b0 SetStdHandle __dosmaperr __wsopen_s 100539->100616 100540 6ccc4115 100540->100535 100540->100537 100614 6ccc4457 CreateFileW 100540->100614 100543 6ccc41ab CloseHandle 100543->100536 100558 6ccc41d4 100543->100558 100545 6ccc415a 100545->100535 100545->100537 100546 6ccc4205 100547 6ccc4251 100546->100547 100617 6ccc4666 70 API calls 2 library calls 100546->100617 100552 6ccc4258 100547->100552 100631 6ccc4710 70 API calls 2 library calls 100547->100631 100550 6ccc4286 100551 6ccc4294 100550->100551 100550->100552 100551->100536 100554 6ccc4310 CloseHandle 100551->100554 100618 6ccbb925 100552->100618 100632 6ccc4457 CreateFileW 100554->100632 100556 6ccc433b 100557 6ccc4345 GetLastError 100556->100557 100556->100558 100559 6ccc4351 __dosmaperr 100557->100559 100558->100536 100633 6ccc171f SetStdHandle __dosmaperr __wsopen_s 100559->100633 100561->100517 100563 6ccabd0b 100562->100563 100564 6ccabd02 100562->100564 100563->100564 100565 6ccb49b2 __Getctype 37 API calls 100563->100565 100564->100524 100570 6ccb69d5 5 API calls std::_Lockit::_Lockit 100564->100570 100566 6ccabd2b 100565->100566 100567 6ccb4f28 __Getctype 37 API calls 100566->100567 100568 6ccabd41 100567->100568 100569 6ccb4f55 __fassign 37 API calls 100568->100569 100569->100564 100570->100524 100572 6ccabe5c 100571->100572 100573 6ccabe76 100571->100573 100574 6ccabddc __wsopen_s HeapFree GetLastError 100572->100574 100575 6ccabe9c 100573->100575 100576 6ccabe7d 100573->100576 100581 6ccabe66 __dosmaperr 100574->100581 100577 6ccb4843 __fassign MultiByteToWideChar 100575->100577 100579 6ccabd9d __wsopen_s HeapFree GetLastError 100576->100579 100576->100581 100578 6ccabeab 100577->100578 100580 6ccabeb2 GetLastError 100578->100580 100582 6ccabed8 100578->100582 100583 6ccabd9d __wsopen_s HeapFree GetLastError 100578->100583 100579->100581 100580->100581 100581->100528 100582->100581 100584 6ccb4843 __fassign MultiByteToWideChar 100582->100584 100583->100582 100585 6ccabeef 100584->100585 100585->100580 100585->100581 100587 6ccc4527 100586->100587 100589 6ccc450d 100586->100589 100588 6ccc447c __wsopen_s 18 API calls 100587->100588 100593 6ccc455f 100588->100593 100589->100587 100590 6ccb0120 __fassign 18 API calls 100589->100590 100590->100587 100591 6ccc458e 100592 6ccc5911 __wsopen_s 18 API calls 100591->100592 100599 6ccc4089 100591->100599 100594 6ccc45dc 100592->100594 100593->100591 100595 6ccb0120 __fassign 18 API calls 100593->100595 100596 6ccc4659 100594->100596 100594->100599 100595->100591 100597 6ccb014d __Getctype 11 API calls 100596->100597 100598 6ccc4665 100597->100598 100599->100536 100600 6ccc160c 100599->100600 100601 6ccc1618 __wsopen_s 100600->100601 100602 6ccb039f std::_Lockit::_Lockit EnterCriticalSection 100601->100602 100603 6ccc161f 100602->100603 100605 6ccc1644 100603->100605 100609 6ccc16b3 EnterCriticalSection 100603->100609 100612 6ccc1666 100603->100612 100604 6ccc1716 __wsopen_s LeaveCriticalSection 100606 6ccc1686 100604->100606 100607 6ccc1842 __wsopen_s 11 API calls 100605->100607 100606->100536 100613 6ccc4457 CreateFileW 100606->100613 100608 6ccc1649 100607->100608 100610 6ccc1990 __wsopen_s EnterCriticalSection 100608->100610 100608->100612 100611 6ccc16c0 LeaveCriticalSection 100609->100611 100609->100612 100610->100612 100611->100603 100612->100604 100613->100540 100614->100545 100615->100543 100616->100546 100617->100547 100619 6ccc15a2 __wsopen_s 18 API calls 100618->100619 100620 6ccbb935 100619->100620 100621 6ccbb93b 100620->100621 100623 6ccc15a2 __wsopen_s 18 API calls 100620->100623 100629 6ccbb96d 100620->100629 100622 6ccc171f __wsopen_s SetStdHandle 100621->100622 100630 6ccbb993 __dosmaperr 100622->100630 100625 6ccbb964 100623->100625 100624 6ccc15a2 __wsopen_s 18 API calls 100626 6ccbb979 CloseHandle 100624->100626 100627 6ccc15a2 __wsopen_s 18 API calls 100625->100627 100626->100621 100628 6ccbb985 GetLastError 100626->100628 100627->100629 100628->100621 100629->100621 100629->100624 100630->100536 100631->100550 100632->100556 100633->100558 100634->100434 100636 6ccb0ba9 100635->100636 100637 6ccb0bbe 100635->100637 100673 6ccb0120 18 API calls __fassign 100636->100673 100640 6ccb0bb9 100637->100640 100651 6ccb0cb9 100637->100651 100640->100437 100645 6ccb0be1 100666 6ccbb898 100645->100666 100647 6ccb0be7 100647->100640 100674 6ccb47bb HeapFree GetLastError _free 100647->100674 100649->100436 100650->100436 100652 6ccb0cd1 100651->100652 100656 6ccb0bd3 100651->100656 100653 6ccb9c60 18 API calls 100652->100653 100652->100656 100654 6ccb0cef 100653->100654 100675 6ccbbb6c 100654->100675 100657 6ccb873e 100656->100657 100658 6ccb0bdb 100657->100658 100659 6ccb8755 100657->100659 100661 6ccb9c60 100658->100661 100659->100658 100763 6ccb47bb HeapFree GetLastError _free 100659->100763 100662 6ccb9c6c 100661->100662 100663 6ccb9c81 100661->100663 100764 6ccb0120 18 API calls __fassign 100662->100764 100663->100645 100665 6ccb9c7c 100665->100645 100667 6ccbb8be 100666->100667 100671 6ccbb8a9 __dosmaperr 100666->100671 100668 6ccbb8e5 100667->100668 100670 6ccbb907 __dosmaperr 100667->100670 100765 6ccbb9c1 100668->100765 100773 6ccb0120 18 API calls __fassign 100670->100773 100671->100647 100673->100640 100674->100640 100676 6ccbbb78 __wsopen_s 100675->100676 100677 6ccbbbca 100676->100677 100678 6ccbbc33 __dosmaperr 100676->100678 100685 6ccbbb80 __dosmaperr 100676->100685 100686 6ccc1990 EnterCriticalSection 100677->100686 100716 6ccb0120 18 API calls __fassign 100678->100716 100680 6ccbbbd0 100683 6ccbbbec __dosmaperr 100680->100683 100687 6ccbbc5e 100680->100687 100715 6ccbbc2b LeaveCriticalSection __wsopen_s 100683->100715 100685->100656 100686->100680 100688 6ccbbc80 100687->100688 100708 6ccbbc9c __dosmaperr 100687->100708 100689 6ccbbcd4 100688->100689 100690 6ccbbc84 __dosmaperr 100688->100690 100691 6ccbbce7 100689->100691 100725 6ccbac69 20 API calls __wsopen_s 100689->100725 100724 6ccb0120 18 API calls __fassign 100690->100724 100717 6ccbbe40 100691->100717 100696 6ccbbcfd 100698 6ccbbd01 100696->100698 100699 6ccbbd26 100696->100699 100697 6ccbbd3c 100700 6ccbbd50 100697->100700 100701 6ccbbd95 WriteFile 100697->100701 100698->100708 100726 6ccbc25b 6 API calls __wsopen_s 100698->100726 100727 6ccbbeb1 43 API calls 5 library calls 100699->100727 100704 6ccbbd5b 100700->100704 100705 6ccbbd85 100700->100705 100703 6ccbbdb9 GetLastError 100701->100703 100701->100708 100703->100708 100709 6ccbbd60 100704->100709 100710 6ccbbd75 100704->100710 100730 6ccbc2c3 7 API calls 2 library calls 100705->100730 100708->100683 100709->100708 100713 6ccbbd65 100709->100713 100729 6ccbc487 8 API calls 3 library calls 100710->100729 100712 6ccbbd73 100712->100708 100728 6ccbc39e 7 API calls 2 library calls 100713->100728 100715->100685 100716->100685 100731 6ccc19e5 100717->100731 100719 6ccbbe51 100720 6ccbbcf8 100719->100720 100736 6ccb49b2 GetLastError 100719->100736 100720->100696 100720->100697 100723 6ccbbe8e GetConsoleMode 100723->100720 100724->100708 100725->100691 100726->100708 100727->100708 100728->100712 100729->100712 100730->100712 100733 6ccc19ff 100731->100733 100734 6ccc19f2 100731->100734 100732 6ccc1a0b 100732->100719 100733->100732 100735 6ccb0120 __fassign 18 API calls 100733->100735 100734->100719 100735->100734 100737 6ccb49c9 100736->100737 100738 6ccb49cf 100736->100738 100739 6ccb6b23 __Getctype 6 API calls 100737->100739 100740 6ccb6b62 __Getctype 6 API calls 100738->100740 100742 6ccb49d5 SetLastError 100738->100742 100739->100738 100741 6ccb49ed 100740->100741 100741->100742 100743 6ccb49f1 100741->100743 100749 6ccb4a69 100742->100749 100750 6ccb4a63 100742->100750 100744 6ccb71e5 __Getctype EnterCriticalSection LeaveCriticalSection HeapAlloc 100743->100744 100745 6ccb49fd 100744->100745 100747 6ccb4a1c 100745->100747 100748 6ccb4a05 100745->100748 100753 6ccb6b62 __Getctype 6 API calls 100747->100753 100751 6ccb6b62 __Getctype 6 API calls 100748->100751 100752 6ccb0ac9 __Getctype 35 API calls 100749->100752 100750->100720 100750->100723 100754 6ccb4a13 100751->100754 100755 6ccb4a6e 100752->100755 100756 6ccb4a28 100753->100756 100759 6ccb47bb _free HeapFree GetLastError 100754->100759 100757 6ccb4a3d 100756->100757 100758 6ccb4a2c 100756->100758 100762 6ccb47bb _free HeapFree GetLastError 100757->100762 100760 6ccb6b62 __Getctype 6 API calls 100758->100760 100761 6ccb4a19 100759->100761 100760->100754 100761->100742 100762->100761 100763->100658 100764->100665 100766 6ccbb9cd __wsopen_s 100765->100766 100774 6ccc1990 EnterCriticalSection 100766->100774 100768 6ccbb9db 100769 6ccbb925 __wsopen_s 21 API calls 100768->100769 100770 6ccbba08 100768->100770 100769->100770 100775 6ccbba41 LeaveCriticalSection __wsopen_s 100770->100775 100772 6ccbba2a 100772->100671 100773->100671 100774->100768 100775->100772 100776->100312 100777->100315 100778->100312 100779->100312 100780->100312 100782 6cb7022e 100781->100782 100783 6cb470c4 100782->100783 100788 6ccb17db 100782->100788 100783->100325 100785->100326 100786->100328 100787->100330 100789 6ccb1806 100788->100789 100790 6ccb17e9 100788->100790 100789->100782 100790->100789 100791 6ccb180a 100790->100791 100792 6ccb17f6 100790->100792 100796 6ccb1a02 100791->100796 100804 6ccb0120 18 API calls __fassign 100792->100804 100797 6ccb1a0e __wsopen_s 100796->100797 100805 6ccac5a9 EnterCriticalSection 100797->100805 100799 6ccb1a1c 100806 6ccb19bf 100799->100806 100803 6ccb183c 100803->100782 100804->100789 100805->100799 100814 6ccb85a6 100806->100814 100812 6ccb19f9 100813 6ccb1a51 LeaveCriticalSection 100812->100813 100813->100803 100815 6ccb9c60 18 API calls 100814->100815 100816 6ccb85b7 100815->100816 100817 6ccc19e5 __wsopen_s 18 API calls 100816->100817 100818 6ccb85bd __wsopen_s 100817->100818 100819 6ccb19d3 100818->100819 100831 6ccb47bb HeapFree GetLastError _free 100818->100831 100821 6ccb183e 100819->100821 100823 6ccb1850 100821->100823 100825 6ccb186e 100821->100825 100822 6ccb185e 100832 6ccb0120 18 API calls __fassign 100822->100832 100823->100822 100823->100825 100828 6ccb1886 _Yarn 100823->100828 100830 6ccb8659 62 API calls 100825->100830 100826 6ccb0cb9 62 API calls 100826->100828 100827 6ccb9c60 18 API calls 100827->100828 100828->100825 100828->100826 100828->100827 100829 6ccbbb6c __wsopen_s 62 API calls 100828->100829 100829->100828 100830->100812 100831->100819 100832->100825 100833 6cb24b53 100834 6cca6a43 std::_Facet_Register 4 API calls 100833->100834 100835 6cb24b5c _Yarn 100834->100835 100836 6cc9aec0 2 API calls 100835->100836 100841 6cb24bae std::ios_base::_Ios_base_dtor 100836->100841 100837 6cb4639e 101035 6ccb0130 18 API calls 2 library calls 100837->101035 100839 6cb24cff 100840 6cb25164 CreateFileA CloseHandle 100845 6cb251ec 100840->100845 100841->100837 100841->100839 100841->100840 100842 6cb3245a _Yarn _strlen 100841->100842 100842->100837 100844 6cc9aec0 2 API calls 100842->100844 100858 6cb32a83 std::ios_base::_Ios_base_dtor 100844->100858 100991 6cca5120 OpenSCManagerA 100845->100991 100847 6cb2fc00 101028 6cca5240 CreateToolhelp32Snapshot 100847->101028 100850 6cca6a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100887 6cb25478 std::ios_base::_Ios_base_dtor _Yarn _strlen 100850->100887 100852 6cb337d0 Sleep 100897 6cb337e0 std::ios_base::_Ios_base_dtor _Yarn _strlen 100852->100897 100853 6cc9aec0 2 API calls 100853->100887 100854 6cb463b2 101036 6cb215e0 18 API calls std::ios_base::_Ios_base_dtor 100854->101036 100855 6cca5240 4 API calls 100874 6cb3053a 100855->100874 100857 6cca5240 4 API calls 100882 6cb312e2 100857->100882 100858->100837 100995 6cc90390 100858->100995 100859 6cb464f8 100860 6cb2ffe3 100860->100855 100866 6cb30abc 100860->100866 100861 6cb46ba0 104 API calls 100861->100887 100862 6cb46e60 32 API calls 100862->100887 100864 6cb47090 77 API calls 100864->100887 100865 6cca5240 4 API calls 100865->100866 100866->100842 100866->100857 100867 6cb26722 101004 6cca1880 25 API calls 4 library calls 100867->101004 100868 6cca5240 4 API calls 100885 6cb31dd9 100868->100885 100869 6cb3211c 100869->100842 100871 6cb3241a 100869->100871 100870 6cb6e010 67 API calls 100870->100887 100873 6cc90390 11 API calls 100871->100873 100872 6cc9aec0 2 API calls 100872->100897 100875 6cb3244d 100873->100875 100874->100865 100874->100866 101034 6cca5d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100875->101034 100877 6cb32452 Sleep 100877->100842 100878 6cb316ac 100879 6cb26162 100881 6cb2740b 101005 6cca4ff0 CreateProcessA 100881->101005 100882->100868 100882->100869 100882->100878 100883 6cca5240 4 API calls 100883->100869 100884 6cb46ba0 104 API calls 100884->100897 100885->100869 100885->100883 100886 6cb46e60 32 API calls 100886->100897 100887->100837 100887->100847 100887->100850 100887->100853 100887->100861 100887->100862 100887->100864 100887->100867 100887->100870 100887->100879 100888 6cb47090 77 API calls 100888->100897 100889 6cb6e010 67 API calls 100889->100897 100890 6cb2775a _strlen 100890->100837 100891 6cb27b92 100890->100891 100892 6cb27ba9 100890->100892 100895 6cb27b43 _Yarn 100890->100895 100893 6cca6a43 std::_Facet_Register 4 API calls 100891->100893 100894 6cca6a43 std::_Facet_Register 4 API calls 100892->100894 100893->100895 100894->100895 100896 6cc9aec0 2 API calls 100895->100896 100906 6cb27be7 std::ios_base::_Ios_base_dtor 100896->100906 100897->100837 100897->100872 100897->100884 100897->100886 100897->100888 100897->100889 100898 6cca4ff0 4 API calls 100909 6cb28a07 100898->100909 100899 6cb29d68 100901 6cca6a43 std::_Facet_Register 4 API calls 100899->100901 100900 6cb29d7f 100902 6cca6a43 std::_Facet_Register 4 API calls 100900->100902 100904 6cb29d18 _Yarn 100901->100904 100902->100904 100903 6cb2962c _strlen 100903->100837 100903->100899 100903->100900 100903->100904 100905 6cc9aec0 2 API calls 100904->100905 100913 6cb29dbd std::ios_base::_Ios_base_dtor 100905->100913 100906->100837 100906->100898 100906->100903 100907 6cb28387 100906->100907 100908 6cca4ff0 4 API calls 100917 6cb29120 100908->100917 100909->100908 100910 6cca4ff0 4 API calls 100927 6cb2a215 _strlen 100910->100927 100911 6cca4ff0 4 API calls 100912 6cb29624 100911->100912 101009 6cca5d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100912->101009 100913->100837 100913->100910 100918 6cb2e8b5 std::ios_base::_Ios_base_dtor _Yarn _strlen 100913->100918 100914 6cca6a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100914->100918 100916 6cc9aec0 2 API calls 100916->100918 100917->100911 100918->100837 100918->100914 100918->100916 100919 6cb2ed02 Sleep 100918->100919 100920 6cb2f7b1 100918->100920 100939 6cb2e8c1 100919->100939 101027 6cca5d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100920->101027 100922 6cb2e8dd GetCurrentProcess TerminateProcess 100922->100918 100923 6cb2a9a4 100925 6cca6a43 std::_Facet_Register 4 API calls 100923->100925 100924 6cb2a9bb 100926 6cca6a43 std::_Facet_Register 4 API calls 100924->100926 100936 6cb2a953 _Yarn _strlen 100925->100936 100926->100936 100927->100837 100927->100923 100927->100924 100927->100936 100928 6cca4ff0 4 API calls 100928->100939 100929 6cb2fbb8 100931 6cb2fbe8 ExitWindowsEx Sleep 100929->100931 100930 6cb2f7c0 100930->100929 100931->100847 100932 6cb2aff0 100934 6cca6a43 std::_Facet_Register 4 API calls 100932->100934 100933 6cb2b009 100935 6cca6a43 std::_Facet_Register 4 API calls 100933->100935 100937 6cb2afa0 _Yarn 100934->100937 100935->100937 100936->100854 100936->100932 100936->100933 100936->100937 101010 6cca5960 100937->101010 100939->100918 100939->100922 100939->100928 100940 6cb2b059 std::ios_base::_Ios_base_dtor _strlen 100940->100837 100941 6cb2b443 100940->100941 100942 6cb2b42c 100940->100942 100945 6cb2b3da _Yarn _strlen 100940->100945 100944 6cca6a43 std::_Facet_Register 4 API calls 100941->100944 100943 6cca6a43 std::_Facet_Register 4 API calls 100942->100943 100943->100945 100944->100945 100945->100854 100946 6cb2b7b7 100945->100946 100947 6cb2b79e 100945->100947 100950 6cb2b751 _Yarn 100945->100950 100949 6cca6a43 std::_Facet_Register 4 API calls 100946->100949 100948 6cca6a43 std::_Facet_Register 4 API calls 100947->100948 100948->100950 100949->100950 100951 6cca5960 104 API calls 100950->100951 100952 6cb2b804 std::ios_base::_Ios_base_dtor _strlen 100951->100952 100952->100837 100953 6cb2bc26 100952->100953 100954 6cb2bc0f 100952->100954 100957 6cb2bbbd _Yarn _strlen 100952->100957 100956 6cca6a43 std::_Facet_Register 4 API calls 100953->100956 100955 6cca6a43 std::_Facet_Register 4 API calls 100954->100955 100955->100957 100956->100957 100957->100854 100958 6cb2c075 100957->100958 100959 6cb2c08e 100957->100959 100962 6cb2c028 _Yarn 100957->100962 100960 6cca6a43 std::_Facet_Register 4 API calls 100958->100960 100961 6cca6a43 std::_Facet_Register 4 API calls 100959->100961 100960->100962 100961->100962 100963 6cca5960 104 API calls 100962->100963 100968 6cb2c0db std::ios_base::_Ios_base_dtor _strlen 100963->100968 100964 6cb2c7a5 100966 6cca6a43 std::_Facet_Register 4 API calls 100964->100966 100965 6cb2c7bc 100967 6cca6a43 std::_Facet_Register 4 API calls 100965->100967 100975 6cb2c753 _Yarn _strlen 100966->100975 100967->100975 100968->100837 100968->100964 100968->100965 100968->100975 100969 6cb2d406 100972 6cca6a43 std::_Facet_Register 4 API calls 100969->100972 100970 6cb2d3ed 100971 6cca6a43 std::_Facet_Register 4 API calls 100970->100971 100973 6cb2d39a _Yarn 100971->100973 100972->100973 100974 6cca5960 104 API calls 100973->100974 100976 6cb2d458 std::ios_base::_Ios_base_dtor _strlen 100974->100976 100975->100854 100975->100969 100975->100970 100975->100973 100981 6cb2cb2f 100975->100981 100976->100837 100977 6cb2d8a4 100976->100977 100978 6cb2d8bb 100976->100978 100982 6cb2d852 _Yarn _strlen 100976->100982 100979 6cca6a43 std::_Facet_Register 4 API calls 100977->100979 100980 6cca6a43 std::_Facet_Register 4 API calls 100978->100980 100979->100982 100980->100982 100982->100854 100983 6cb2dcb6 100982->100983 100984 6cb2dccf 100982->100984 100987 6cb2dc69 _Yarn 100982->100987 100985 6cca6a43 std::_Facet_Register 4 API calls 100983->100985 100986 6cca6a43 std::_Facet_Register 4 API calls 100984->100986 100985->100987 100986->100987 100988 6cca5960 104 API calls 100987->100988 100990 6cb2dd1c std::ios_base::_Ios_base_dtor 100988->100990 100989 6cca4ff0 4 API calls 100989->100918 100990->100837 100990->100989 100992 6cca5156 100991->100992 100993 6cca51e8 OpenServiceA 100992->100993 100994 6cca522f 100992->100994 100993->100992 100994->100887 101000 6cc903a3 _Yarn __wsopen_s std::locale::_Setgloballocale _strlen 100995->101000 100996 6cc9310e CloseHandle 100996->101000 100997 6cc93f5f CloseHandle 100997->101000 100998 6cc9251b CloseHandle 100998->101000 100999 6cb337cb 101003 6cca5d60 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100999->101003 101000->100996 101000->100997 101000->100998 101000->100999 101001 6cc7c1e0 WriteFile WriteFile WriteFile ReadFile 101000->101001 101037 6cc7b730 101000->101037 101001->101000 101003->100852 101004->100881 101006 6cca50ca 101005->101006 101007 6cca5080 WaitForSingleObject CloseHandle CloseHandle 101006->101007 101008 6cca50e3 101006->101008 101007->101006 101008->100890 101009->100903 101011 6cca59b7 101010->101011 101048 6cca5ff0 101011->101048 101013 6cca59c8 101014 6cb46ba0 104 API calls 101013->101014 101020 6cca59ec 101014->101020 101015 6cca5a67 101016 6cb6e010 67 API calls 101015->101016 101017 6cca5a9f std::ios_base::_Ios_base_dtor 101016->101017 101019 6cb6e010 67 API calls 101017->101019 101022 6cca5ae2 std::ios_base::_Ios_base_dtor 101019->101022 101020->101015 101021 6cca5a54 101020->101021 101067 6cca6340 101020->101067 101075 6cb82000 101020->101075 101085 6cca5b90 101021->101085 101022->100940 101025 6cca5a5c 101026 6cb47090 77 API calls 101025->101026 101026->101015 101027->100930 101031 6cca52a0 std::locale::_Setgloballocale 101028->101031 101029 6cca5320 Process32NextW 101029->101031 101030 6cca5277 CloseHandle 101030->101031 101031->101029 101031->101030 101032 6cca53b1 101031->101032 101033 6cca5345 Process32FirstW 101031->101033 101032->100860 101033->101031 101034->100877 101036->100859 101038 6cc7b743 _Yarn __wsopen_s std::locale::_Setgloballocale 101037->101038 101039 6cc7c180 101038->101039 101040 6cc7bced CreateFileA 101038->101040 101042 6cc7aa30 101038->101042 101039->101000 101040->101038 101045 6cc7aa43 __wsopen_s std::locale::_Setgloballocale 101042->101045 101043 6cc7b3e9 WriteFile 101043->101045 101044 6cc7b43d WriteFile 101044->101045 101045->101043 101045->101044 101046 6cc7b718 101045->101046 101047 6cc7ab95 ReadFile 101045->101047 101046->101038 101047->101045 101049 6cca6025 101048->101049 101050 6cb72020 52 API calls 101049->101050 101051 6cca60c6 101050->101051 101052 6cca6a43 std::_Facet_Register 4 API calls 101051->101052 101053 6cca60fe 101052->101053 101054 6cca7327 43 API calls 101053->101054 101055 6cca6112 101054->101055 101056 6cb71d90 89 API calls 101055->101056 101057 6cca61bb 101056->101057 101058 6cca61ec 101057->101058 101100 6cb72250 30 API calls 101057->101100 101058->101013 101060 6cca6226 101101 6cb726e0 24 API calls 4 library calls 101060->101101 101062 6cca6238 101102 6cca9379 RaiseException 101062->101102 101064 6cca624d 101065 6cb6e010 67 API calls 101064->101065 101066 6cca625f 101065->101066 101066->101013 101068 6cca638d 101067->101068 101103 6cca65a0 101068->101103 101070 6cca647c 101070->101020 101072 6cca63a5 101072->101070 101121 6cb72250 30 API calls 101072->101121 101122 6cb726e0 24 API calls 4 library calls 101072->101122 101123 6cca9379 RaiseException 101072->101123 101076 6cb8203f 101075->101076 101077 6cb82053 101076->101077 101132 6cb73560 32 API calls std::_Xinvalid_argument 101076->101132 101080 6cb8210e 101077->101080 101134 6cb72250 30 API calls 101077->101134 101135 6cb726e0 24 API calls 4 library calls 101077->101135 101136 6cca9379 RaiseException 101077->101136 101083 6cb82121 101080->101083 101133 6cb737e0 32 API calls std::_Xinvalid_argument 101080->101133 101083->101020 101086 6cca5b9e 101085->101086 101090 6cca5bd1 101085->101090 101087 6cb701f0 64 API calls 101086->101087 101089 6cca5bc4 101087->101089 101088 6cca5c83 101088->101025 101091 6ccb0b18 67 API calls 101089->101091 101090->101088 101137 6cb72250 30 API calls 101090->101137 101091->101090 101093 6cca5cae 101138 6cb72340 24 API calls 101093->101138 101095 6cca5cbe 101139 6cca9379 RaiseException 101095->101139 101097 6cca5cc9 101098 6cb6e010 67 API calls 101097->101098 101099 6cca5d22 std::ios_base::_Ios_base_dtor 101098->101099 101099->101025 101100->101060 101101->101062 101102->101064 101104 6cca6608 101103->101104 101105 6cca65dc 101103->101105 101111 6cca6619 101104->101111 101124 6cb73560 32 API calls std::_Xinvalid_argument 101104->101124 101119 6cca6601 101105->101119 101126 6cb72250 30 API calls 101105->101126 101108 6cca67e8 101127 6cb72340 24 API calls 101108->101127 101110 6cca67f7 101128 6cca9379 RaiseException 101110->101128 101111->101119 101125 6cb72f60 42 API calls 4 library calls 101111->101125 101115 6cca6827 101130 6cb72340 24 API calls 101115->101130 101117 6cca683d 101131 6cca9379 RaiseException 101117->101131 101119->101072 101120 6cca6653 101120->101119 101129 6cb72250 30 API calls 101120->101129 101121->101072 101122->101072 101123->101072 101124->101111 101125->101120 101126->101108 101127->101110 101128->101120 101129->101115 101130->101117 101131->101119 101132->101077 101133->101083 101134->101077 101135->101077 101136->101077 101137->101093 101138->101095 101139->101097 101140 6cb34a27 101142 6cb34a5d _strlen 101140->101142 101141 6cb4639e 101231 6ccb0130 18 API calls 2 library calls 101141->101231 101142->101141 101143 6cb35b58 101142->101143 101144 6cb35b6f 101142->101144 101148 6cb35b09 _Yarn 101142->101148 101147 6cca6a43 std::_Facet_Register 4 API calls 101143->101147 101145 6cca6a43 std::_Facet_Register 4 API calls 101144->101145 101145->101148 101147->101148 101149 6cc9aec0 2 API calls 101148->101149 101151 6cb35bad std::ios_base::_Ios_base_dtor 101149->101151 101150 6cca4ff0 4 API calls 101160 6cb361cb _strlen 101150->101160 101151->101141 101151->101150 101154 6cb39ba5 std::ios_base::_Ios_base_dtor _Yarn _strlen 101151->101154 101152 6cca6a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 101152->101154 101153 6cc9aec0 2 API calls 101153->101154 101154->101141 101154->101152 101154->101153 101155 6cb3a292 Sleep 101154->101155 101173 6cb3e619 101154->101173 101172 6cb39bb1 std::ios_base::_Ios_base_dtor _Yarn _strlen 101155->101172 101156 6cb36624 101158 6cca6a43 std::_Facet_Register 4 API calls 101156->101158 101157 6cb3660d 101159 6cca6a43 std::_Facet_Register 4 API calls 101157->101159 101163 6cb365bc _Yarn _strlen 101158->101163 101159->101163 101160->101141 101160->101156 101160->101157 101160->101163 101161 6cb39bbd GetCurrentProcess TerminateProcess 101161->101154 101162 6cb463b2 101232 6cb215e0 18 API calls std::ios_base::_Ios_base_dtor 101162->101232 101163->101162 101166 6cb36970 101163->101166 101167 6cb36989 101163->101167 101170 6cb36920 _Yarn 101163->101170 101165 6cb464f8 101168 6cca6a43 std::_Facet_Register 4 API calls 101166->101168 101169 6cca6a43 std::_Facet_Register 4 API calls 101167->101169 101168->101170 101169->101170 101171 6cca5960 104 API calls 101170->101171 101175 6cb369d6 std::ios_base::_Ios_base_dtor _strlen 101171->101175 101172->101141 101172->101154 101172->101161 101172->101162 101190 6cca6a43 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 101172->101190 101229 6cca5960 104 API calls 101172->101229 101230 6cca4ff0 CreateProcessA WaitForSingleObject CloseHandle CloseHandle 101172->101230 101174 6cb3f243 CreateFileA 101173->101174 101188 6cb3f2a7 101174->101188 101175->101141 101176 6cb36dd2 101175->101176 101177 6cb36dbb 101175->101177 101189 6cb36d69 _Yarn _strlen 101175->101189 101180 6cca6a43 std::_Facet_Register 4 API calls 101176->101180 101179 6cca6a43 std::_Facet_Register 4 API calls 101177->101179 101178 6cb402ca 101179->101189 101180->101189 101181 6cb37440 101184 6cca6a43 std::_Facet_Register 4 API calls 101181->101184 101182 6cb37427 101183 6cca6a43 std::_Facet_Register 4 API calls 101182->101183 101185 6cb373da _Yarn 101183->101185 101184->101185 101187 6cca5960 104 API calls 101185->101187 101186 6cb402ac GetCurrentProcess TerminateProcess 101186->101178 101191 6cb3748d std::ios_base::_Ios_base_dtor _strlen 101187->101191 101188->101178 101188->101186 101189->101162 101189->101181 101189->101182 101189->101185 101190->101172 101191->101141 101192 6cb37991 101191->101192 101193 6cb379a8 101191->101193 101198 6cb37940 _Yarn _strlen 101191->101198 101194 6cca6a43 std::_Facet_Register 4 API calls 101192->101194 101195 6cca6a43 std::_Facet_Register 4 API calls 101193->101195 101194->101198 101195->101198 101196 6cb37de2 101200 6cca6a43 std::_Facet_Register 4 API calls 101196->101200 101197 6cb37dc9 101199 6cca6a43 std::_Facet_Register 4 API calls 101197->101199 101198->101162 101198->101196 101198->101197 101201 6cb37d7c _Yarn 101198->101201 101199->101201 101200->101201 101202 6cca5960 104 API calls 101201->101202 101203 6cb37e2f std::ios_base::_Ios_base_dtor _strlen 101202->101203 101203->101141 101204 6cb385a8 101203->101204 101205 6cb385bf 101203->101205 101213 6cb38556 _Yarn _strlen 101203->101213 101206 6cca6a43 std::_Facet_Register 4 API calls 101204->101206 101207 6cca6a43 std::_Facet_Register 4 API calls 101205->101207 101206->101213 101207->101213 101208 6cb38983 101211 6cca6a43 std::_Facet_Register 4 API calls 101208->101211 101209 6cb3896a 101210 6cca6a43 std::_Facet_Register 4 API calls 101209->101210 101212 6cb3891d _Yarn 101210->101212 101211->101212 101214 6cca5960 104 API calls 101212->101214 101213->101162 101213->101208 101213->101209 101213->101212 101215 6cb389d0 std::ios_base::_Ios_base_dtor _strlen 101214->101215 101215->101141 101216 6cb38f36 101215->101216 101217 6cb38f1f 101215->101217 101220 6cb38ecd _Yarn _strlen 101215->101220 101219 6cca6a43 std::_Facet_Register 4 API calls 101216->101219 101218 6cca6a43 std::_Facet_Register 4 API calls 101217->101218 101218->101220 101219->101220 101220->101162 101221 6cb39354 101220->101221 101222 6cb3936d 101220->101222 101225 6cb39307 _Yarn 101220->101225 101224 6cca6a43 std::_Facet_Register 4 API calls 101221->101224 101223 6cca6a43 std::_Facet_Register 4 API calls 101222->101223 101223->101225 101224->101225 101226 6cca5960 104 API calls 101225->101226 101228 6cb393ba std::ios_base::_Ios_base_dtor 101226->101228 101227 6cca4ff0 4 API calls 101227->101154 101228->101141 101228->101227 101229->101172 101230->101172 101232->101165 101233 6ccaef3f 101234 6ccaef4b __wsopen_s 101233->101234 101235 6ccaef5f 101234->101235 101236 6ccaef52 GetLastError ExitThread 101234->101236 101237 6ccb49b2 __Getctype 37 API calls 101235->101237 101238 6ccaef64 101237->101238 101245 6ccb9d66 101238->101245 101241 6ccaef7b 101251 6ccaeeaa 16 API calls 2 library calls 101241->101251 101244 6ccaef9d 101246 6ccb9d78 GetPEB 101245->101246 101249 6ccaef6f 101245->101249 101247 6ccb9d8b 101246->101247 101246->101249 101252 6ccb6e18 5 API calls std::_Lockit::_Lockit 101247->101252 101249->101241 101250 6ccb6d6f 5 API calls std::_Lockit::_Lockit 101249->101250 101250->101241 101251->101244 101252->101249 101253 6ccbcad3 101254 6ccbcae5 __dosmaperr 101253->101254 101255 6ccbcafd 101253->101255 101255->101254 101256 6ccbcb77 101255->101256 101258 6ccbcb48 __dosmaperr 101255->101258 101259 6ccbcb90 101256->101259 101260 6ccbcbab __dosmaperr 101256->101260 101261 6ccbcbe7 __wsopen_s 101256->101261 101295 6ccb0120 18 API calls __fassign 101258->101295 101259->101260 101280 6ccbcb95 101259->101280 101288 6ccb0120 18 API calls __fassign 101260->101288 101289 6ccb47bb HeapFree GetLastError _free 101261->101289 101262 6ccc19e5 __wsopen_s 18 API calls 101264 6ccbcd3e 101262->101264 101267 6ccbcdb4 101264->101267 101268 6ccbcd57 GetConsoleMode 101264->101268 101265 6ccbcc07 101290 6ccb47bb HeapFree GetLastError _free 101265->101290 101270 6ccbcdb8 ReadFile 101267->101270 101268->101267 101271 6ccbcd68 101268->101271 101273 6ccbce2c GetLastError 101270->101273 101274 6ccbcdd2 101270->101274 101271->101270 101275 6ccbcd6e ReadConsoleW 101271->101275 101272 6ccbcc0e 101285 6ccbcbc2 __dosmaperr __wsopen_s 101272->101285 101291 6ccbac69 20 API calls __wsopen_s 101272->101291 101273->101285 101274->101273 101276 6ccbcda9 101274->101276 101275->101276 101278 6ccbcd8a GetLastError 101275->101278 101281 6ccbce0e 101276->101281 101282 6ccbcdf7 101276->101282 101276->101285 101278->101285 101280->101262 101284 6ccbce25 101281->101284 101281->101285 101293 6ccbcefe 23 API calls 3 library calls 101282->101293 101294 6ccbd1b6 21 API calls __wsopen_s 101284->101294 101292 6ccb47bb HeapFree GetLastError _free 101285->101292 101287 6ccbce2a 101287->101285 101288->101285 101289->101265 101290->101272 101291->101280 101292->101254 101293->101285 101294->101287 101295->101254

                            Executed Functions

                            Function 6CB24754 Relevance: 69.2, APIs: 28, Strings: 1, Instructions: 18471COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: _strlen
                            • String ID: HR^
                            • API String ID: 4218353326-1341859651
                            • Opcode ID: 3445a2e8fe7feeb129d112e32bf4bcf1f7a6de10513caa5e4cf6ebe4e23fcfc5
                            • Instruction ID: 0779cae50fbd757507bfbead09ed087beeb83bc10fc84b4fe194bef2a03ccbed
                            • Opcode Fuzzy Hash: 3445a2e8fe7feeb129d112e32bf4bcf1f7a6de10513caa5e4cf6ebe4e23fcfc5
                            • Instruction Fuzzy Hash: 2C741871644B418FC728CF28C8D06A6B7F3FF953187198A2DC09A8BB55E778B54ACB41
                            Function 6CB34A27 Relevance: 61.3, APIs: 25, Strings: 3, Instructions: 12265COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: }jk$;T55$L@^
                            • API String ID: 0-4218709813
                            • Opcode ID: 7af30f2f9e584a66f649f90908424efd6bdcf4200674761e56692fc86b8417d5
                            • Instruction ID: aa12a2f4b849e7f91638309286e143fbb638770e044babff501e9c7d10e9aabf
                            • Opcode Fuzzy Hash: 7af30f2f9e584a66f649f90908424efd6bdcf4200674761e56692fc86b8417d5
                            • Instruction Fuzzy Hash: FC342971644B91CFC728CF28C8D0696B7F3EF85314B198A2DC09A8BB55EB74B54ACB41
                            Function 6CCA5240 Relevance: 6.1, APIs: 4, Instructions: 95processCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7677 6cca5240-6cca5275 CreateToolhelp32Snapshot 7678 6cca52a0-6cca52a9 7677->7678 7679 6cca52ab-6cca52b0 7678->7679 7680 6cca52e0-6cca52e5 7678->7680 7681 6cca52b2-6cca52b7 7679->7681 7682 6cca5315-6cca531a 7679->7682 7683 6cca52eb-6cca52f0 7680->7683 7684 6cca5377-6cca53a1 call 6ccb2c05 7680->7684 7688 6cca52b9-6cca52be 7681->7688 7689 6cca5334-6cca535d call 6ccab920 Process32FirstW 7681->7689 7685 6cca5320-6cca5332 Process32NextW 7682->7685 7686 6cca53a6-6cca53ab 7682->7686 7690 6cca52f2-6cca52f7 7683->7690 7691 6cca5277-6cca5292 CloseHandle 7683->7691 7684->7678 7692 6cca5362-6cca5372 7685->7692 7686->7678 7695 6cca53b1-6cca53bf 7686->7695 7688->7678 7696 6cca52c0-6cca52d1 7688->7696 7689->7692 7690->7678 7697 6cca52f9-6cca5313 7690->7697 7691->7678 7692->7678 7696->7678 7697->7678
                            APIs
                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6CCA524E
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CreateSnapshotToolhelp32
                            • String ID:
                            • API String ID: 3332741929-0
                            • Opcode ID: 3bc39f23bcc1dfddf4a4c659c1b31c4dd03e905089df3d77e4a37f48ff5077b1
                            • Instruction ID: d0d67f6a88160149d680df3c4d2a1ed731f31886c76b01ce68d93725dd6010ba
                            • Opcode Fuzzy Hash: 3bc39f23bcc1dfddf4a4c659c1b31c4dd03e905089df3d77e4a37f48ff5077b1
                            • Instruction Fuzzy Hash: 7E31C0786093069FD7109FA9C888B4ABBF4BF85744F518A2DF588C7360E771D8498B53
                            Function 6CB23886 Relevance: 3.6, APIs: 2, Instructions: 573COMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7821 6cb23886-6cb2388e 7822 6cb23970-6cb2397d 7821->7822 7823 6cb23894-6cb23896 7821->7823 7824 6cb239f1-6cb239f8 7822->7824 7825 6cb2397f-6cb23989 7822->7825 7823->7822 7826 6cb2389c-6cb238b9 7823->7826 7828 6cb23ab5-6cb23aba 7824->7828 7829 6cb239fe-6cb23a03 7824->7829 7825->7826 7827 6cb2398f-6cb23994 7825->7827 7830 6cb238c0-6cb238c1 7826->7830 7831 6cb23b16-6cb23b18 7827->7831 7832 6cb2399a-6cb2399f 7827->7832 7828->7826 7836 6cb23ac0-6cb23ac7 7828->7836 7833 6cb238d2-6cb238d4 7829->7833 7834 6cb23a09-6cb23a2f 7829->7834 7835 6cb2395e 7830->7835 7831->7830 7838 6cb239a5-6cb239bf 7832->7838 7839 6cb2383b-6cb23855 call 6cc71470 call 6cc71480 7832->7839 7842 6cb23957-6cb2395c 7833->7842 7840 6cb23a35-6cb23a3a 7834->7840 7841 6cb238f8-6cb23955 7834->7841 7843 6cb23960-6cb23964 7835->7843 7836->7830 7837 6cb23acd-6cb23ad6 7836->7837 7837->7831 7846 6cb23ad8-6cb23aeb 7837->7846 7847 6cb23a5a-6cb23a5d 7838->7847 7844 6cb23860-6cb23885 7839->7844 7848 6cb23a40-6cb23a57 7840->7848 7849 6cb23b1d-6cb23b22 7840->7849 7841->7842 7842->7835 7843->7844 7845 6cb2396a 7843->7845 7844->7821 7852 6cb23ba1-6cb23bb6 7845->7852 7846->7841 7853 6cb23af1-6cb23af8 7846->7853 7857 6cb23aa9-6cb23ab0 7847->7857 7848->7847 7855 6cb23b24-6cb23b44 7849->7855 7856 6cb23b49-6cb23b50 7849->7856 7864 6cb23bc0-6cb23bda call 6cc71470 call 6cc71480 7852->7864 7859 6cb23b62-6cb23b85 7853->7859 7860 6cb23afa-6cb23aff 7853->7860 7855->7857 7856->7830 7863 6cb23b56-6cb23b5d 7856->7863 7857->7843 7859->7841 7867 6cb23b8b 7859->7867 7860->7842 7863->7843 7872 6cb23be0-6cb23bfe 7864->7872 7867->7852 7875 6cb23c04-6cb23c11 7872->7875 7876 6cb23e7b 7872->7876 7878 6cb23ce0-6cb23cea 7875->7878 7879 6cb23c17-6cb23c20 7875->7879 7877 6cb23e81-6cb23ee0 call 6cb23750 GetCurrentThread NtSetInformationThread 7876->7877 7894 6cb23eea-6cb23f04 call 6cc71470 call 6cc71480 7877->7894 7883 6cb23d3a-6cb23d3c 7878->7883 7884 6cb23cec-6cb23d0c 7878->7884 7881 6cb23c26-6cb23c2d 7879->7881 7882 6cb23dc5 7879->7882 7887 6cb23dc3 7881->7887 7888 6cb23c33-6cb23c3a 7881->7888 7886 6cb23dc6 7882->7886 7890 6cb23d70-6cb23d8d 7883->7890 7891 6cb23d3e-6cb23d45 7883->7891 7889 6cb23d90-6cb23d95 7884->7889 7897 6cb23dc8-6cb23dcc 7886->7897 7887->7882 7895 6cb23c40-6cb23c5b 7888->7895 7896 6cb23e26-6cb23e2b 7888->7896 7892 6cb23d97-6cb23db8 7889->7892 7893 6cb23dba-6cb23dc1 7889->7893 7890->7889 7898 6cb23d50-6cb23d57 7891->7898 7892->7882 7893->7887 7900 6cb23dd7-6cb23ddc 7893->7900 7915 6cb23f75-6cb23fa1 7894->7915 7902 6cb23e1b-6cb23e24 7895->7902 7903 6cb23e31 7896->7903 7904 6cb23c7b-6cb23cd0 7896->7904 7897->7872 7899 6cb23dd2 7897->7899 7898->7886 7905 6cb23e76-6cb23e79 7899->7905 7906 6cb23e36-6cb23e3d 7900->7906 7907 6cb23dde-6cb23e17 7900->7907 7902->7897 7902->7905 7903->7864 7904->7898 7905->7877 7911 6cb23e3f-6cb23e5a 7906->7911 7912 6cb23e5c-6cb23e5f 7906->7912 7907->7902 7911->7902 7912->7904 7914 6cb23e65-6cb23e69 7912->7914 7914->7897 7914->7905 7919 6cb23fa3-6cb23fa8 7915->7919 7920 6cb24020-6cb24026 7915->7920 7921 6cb23fae-6cb23fcf 7919->7921 7922 6cb2407c-6cb24081 7919->7922 7923 6cb23f06-6cb23f35 7920->7923 7924 6cb2402c-6cb2403c 7920->7924 7925 6cb240aa-6cb240ae 7921->7925 7922->7925 7929 6cb24083-6cb2408a 7922->7929 7926 6cb23f38-6cb23f61 7923->7926 7927 6cb240b3-6cb240b8 7924->7927 7928 6cb2403e-6cb24058 7924->7928 7930 6cb23f6b-6cb23f6f 7925->7930 7931 6cb23f64-6cb23f67 7926->7931 7927->7921 7934 6cb240be-6cb240c9 7927->7934 7932 6cb2405a-6cb24063 7928->7932 7929->7926 7933 6cb24090 7929->7933 7930->7915 7935 6cb23f69 7931->7935 7936 6cb240f5-6cb2413f 7932->7936 7937 6cb24069-6cb2406c 7932->7937 7933->7894 7938 6cb240a7 7933->7938 7934->7925 7939 6cb240cb-6cb240d4 7934->7939 7935->7930 7936->7935 7941 6cb24072-6cb24077 7937->7941 7942 6cb24144-6cb2414b 7937->7942 7938->7925 7939->7938 7943 6cb240d6-6cb240f0 7939->7943 7941->7931 7942->7930 7943->7932
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 136e0e0b95b075ede9e142cd3ca43505918aafc9865746203d5751dbbfd28a8f
                            • Instruction ID: 659040b323f43be1c18903cb1cb52dbd4d1d2958854662095a52c54847946fab
                            • Opcode Fuzzy Hash: 136e0e0b95b075ede9e142cd3ca43505918aafc9865746203d5751dbbfd28a8f
                            • Instruction Fuzzy Hash: FA321432245B418FC324CF28C8D06A6B7E7EFD13147698A6CC0EE4BA95D779B44ACB51
                            Function 6CB23A6A Relevance: 3.1, APIs: 2, Instructions: 148threadCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7969 6cb23a6a-6cb23a85 7970 6cb23a87-6cb23aa7 7969->7970 7971 6cb23aa9-6cb23ab0 7970->7971 7972 6cb23960-6cb23964 7971->7972 7973 6cb23860-6cb2388e 7972->7973 7974 6cb2396a 7972->7974 7984 6cb23970-6cb2397d 7973->7984 7985 6cb23894-6cb23896 7973->7985 7975 6cb23ba1-6cb23bb6 7974->7975 7978 6cb23bc0-6cb23bda call 6cc71470 call 6cc71480 7975->7978 7990 6cb23be0-6cb23bfe 7978->7990 7987 6cb239f1-6cb239f8 7984->7987 7988 6cb2397f-6cb23989 7984->7988 7985->7984 7989 6cb2389c-6cb238b9 7985->7989 7992 6cb23ab5-6cb23aba 7987->7992 7993 6cb239fe-6cb23a03 7987->7993 7988->7989 7991 6cb2398f-6cb23994 7988->7991 7994 6cb238c0-6cb238c1 7989->7994 8010 6cb23c04-6cb23c11 7990->8010 8011 6cb23e7b 7990->8011 7996 6cb23b16-6cb23b18 7991->7996 7997 6cb2399a-6cb2399f 7991->7997 7992->7989 8001 6cb23ac0-6cb23ac7 7992->8001 7998 6cb238d2-6cb238d4 7993->7998 7999 6cb23a09-6cb23a2f 7993->7999 8000 6cb2395e 7994->8000 7996->7994 8004 6cb239a5-6cb239bf 7997->8004 8005 6cb2383b-6cb23855 call 6cc71470 call 6cc71480 7997->8005 8008 6cb23957-6cb2395c 7998->8008 8006 6cb23a35-6cb23a3a 7999->8006 8007 6cb238f8-6cb23955 7999->8007 8000->7972 8001->7994 8002 6cb23acd-6cb23ad6 8001->8002 8002->7996 8009 6cb23ad8-6cb23aeb 8002->8009 8012 6cb23a5a-6cb23a5d 8004->8012 8005->7973 8013 6cb23a40-6cb23a57 8006->8013 8014 6cb23b1d-6cb23b22 8006->8014 8007->8008 8008->8000 8009->8007 8018 6cb23af1-6cb23af8 8009->8018 8019 6cb23ce0-6cb23cea 8010->8019 8020 6cb23c17-6cb23c20 8010->8020 8016 6cb23e81-6cb23ee0 call 6cb23750 GetCurrentThread NtSetInformationThread 8011->8016 8012->7971 8013->8012 8021 6cb23b24-6cb23b44 8014->8021 8022 6cb23b49-6cb23b50 8014->8022 8043 6cb23eea-6cb23f04 call 6cc71470 call 6cc71480 8016->8043 8025 6cb23b62-6cb23b85 8018->8025 8026 6cb23afa-6cb23aff 8018->8026 8030 6cb23d3a-6cb23d3c 8019->8030 8031 6cb23cec-6cb23d0c 8019->8031 8027 6cb23c26-6cb23c2d 8020->8027 8028 6cb23dc5 8020->8028 8021->7970 8022->7994 8029 6cb23b56-6cb23b5d 8022->8029 8025->8007 8037 6cb23b8b 8025->8037 8026->8008 8035 6cb23dc3 8027->8035 8036 6cb23c33-6cb23c3a 8027->8036 8034 6cb23dc6 8028->8034 8029->7972 8039 6cb23d70-6cb23d8d 8030->8039 8040 6cb23d3e-6cb23d45 8030->8040 8038 6cb23d90-6cb23d95 8031->8038 8046 6cb23dc8-6cb23dcc 8034->8046 8035->8028 8044 6cb23c40-6cb23c5b 8036->8044 8045 6cb23e26-6cb23e2b 8036->8045 8037->7975 8041 6cb23d97-6cb23db8 8038->8041 8042 6cb23dba-6cb23dc1 8038->8042 8039->8038 8047 6cb23d50-6cb23d57 8040->8047 8041->8028 8042->8035 8049 6cb23dd7-6cb23ddc 8042->8049 8064 6cb23f75-6cb23fa1 8043->8064 8051 6cb23e1b-6cb23e24 8044->8051 8052 6cb23e31 8045->8052 8053 6cb23c7b-6cb23cd0 8045->8053 8046->7990 8048 6cb23dd2 8046->8048 8047->8034 8054 6cb23e76-6cb23e79 8048->8054 8055 6cb23e36-6cb23e3d 8049->8055 8056 6cb23dde-6cb23e17 8049->8056 8051->8046 8051->8054 8052->7978 8053->8047 8054->8016 8060 6cb23e3f-6cb23e5a 8055->8060 8061 6cb23e5c-6cb23e5f 8055->8061 8056->8051 8060->8051 8061->8053 8063 6cb23e65-6cb23e69 8061->8063 8063->8046 8063->8054 8068 6cb23fa3-6cb23fa8 8064->8068 8069 6cb24020-6cb24026 8064->8069 8070 6cb23fae-6cb23fcf 8068->8070 8071 6cb2407c-6cb24081 8068->8071 8072 6cb23f06-6cb23f35 8069->8072 8073 6cb2402c-6cb2403c 8069->8073 8074 6cb240aa-6cb240ae 8070->8074 8071->8074 8078 6cb24083-6cb2408a 8071->8078 8075 6cb23f38-6cb23f61 8072->8075 8076 6cb240b3-6cb240b8 8073->8076 8077 6cb2403e-6cb24058 8073->8077 8079 6cb23f6b-6cb23f6f 8074->8079 8080 6cb23f64-6cb23f67 8075->8080 8076->8070 8083 6cb240be-6cb240c9 8076->8083 8081 6cb2405a-6cb24063 8077->8081 8078->8075 8082 6cb24090 8078->8082 8079->8064 8084 6cb23f69 8080->8084 8085 6cb240f5-6cb2413f 8081->8085 8086 6cb24069-6cb2406c 8081->8086 8082->8043 8087 6cb240a7 8082->8087 8083->8074 8088 6cb240cb-6cb240d4 8083->8088 8084->8079 8085->8084 8090 6cb24072-6cb24077 8086->8090 8091 6cb24144-6cb2414b 8086->8091 8087->8074 8088->8087 8092 6cb240d6-6cb240f0 8088->8092 8090->8080 8091->8079 8092->8081
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CurrentThread
                            • String ID:
                            • API String ID: 2882836952-0
                            • Opcode ID: 7d76c5a98d66bfe8cbd1eadf5a4d78a56c02ddac9ceadd3bde93bdd15694e923
                            • Instruction ID: d93c262ed6bd156c4f9e834094e29d254178b9fc596f1ba6a107a7c7fccf529f
                            • Opcode Fuzzy Hash: 7d76c5a98d66bfe8cbd1eadf5a4d78a56c02ddac9ceadd3bde93bdd15694e923
                            • Instruction Fuzzy Hash: DC51E0311447818FC320CF28C8807E6B7E7FF95314F698A5DC0EA1BA95DB78B44A8B51
                            Function 6CB239CF Relevance: 3.1, APIs: 2, Instructions: 139threadCOMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CurrentThread
                            • String ID:
                            • API String ID: 2882836952-0
                            • Opcode ID: 7888929d417d58a427461f40e5d1aac439f4e2d1f4dabf17c4c6c5d923b15434
                            • Instruction ID: 9ce2cababc10a5997bef84ddd8eaab030140d8b85fbe71a4fe3b6dd5352ca236
                            • Opcode Fuzzy Hash: 7888929d417d58a427461f40e5d1aac439f4e2d1f4dabf17c4c6c5d923b15434
                            • Instruction Fuzzy Hash: 4751D231104B818BC320CF28C4807A6B7E7FF95314F698B1DC0EA5BA95DB78B44A8B51
                            Function 6CB23D18 Relevance: 3.1, APIs: 2, Instructions: 89threadnativeCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentThread.KERNEL32 ref: 6CB23E9D
                            • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6CB23EAA
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Thread$CurrentInformation
                            • String ID:
                            • API String ID: 1650627709-0
                            • Opcode ID: 87ff32d9d1e1290f75f953ab9e2dad3122cc39bf59fee48226a750c0ce9471e7
                            • Instruction ID: c041aa4de678530d0aa4b34fd5961426cb2072e7a5e00de0a0e758037c2dea14
                            • Opcode Fuzzy Hash: 87ff32d9d1e1290f75f953ab9e2dad3122cc39bf59fee48226a750c0ce9471e7
                            • Instruction Fuzzy Hash: B2310131155B818BD720CF28C8947E6B7A7EF96314F194A1DC0AA5BA90DB78700A9B61
                            Function 6CB23D62 Relevance: 3.1, APIs: 2, Instructions: 83threadnativeCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentThread.KERNEL32 ref: 6CB23E9D
                            • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6CB23EAA
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Thread$CurrentInformation
                            • String ID:
                            • API String ID: 1650627709-0
                            • Opcode ID: 655c1900a672a8762ec6d6f30ba7a7b91f9de96802068a045fd3361861c87cdc
                            • Instruction ID: c84128562a29eddadc13c8ee7f597b369607a359c01431a5b38f8460723a14ec
                            • Opcode Fuzzy Hash: 655c1900a672a8762ec6d6f30ba7a7b91f9de96802068a045fd3361861c87cdc
                            • Instruction Fuzzy Hash: 59312131114781CBD724CF28C4947A6BBBAEF96304F294E1CC0EE4BA85DB797449CB52
                            Function 6CB23C62 Relevance: 3.1, APIs: 2, Instructions: 72threadnativeCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentThread.KERNEL32 ref: 6CB23E9D
                            • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6CB23EAA
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Thread$CurrentInformation
                            • String ID:
                            • API String ID: 1650627709-0
                            • Opcode ID: 428e4268442bc8e5e936daba632dce075d974fe806ee7899692ebdab53b6c5b0
                            • Instruction ID: 9d2aed8f63bb2908337fa1140ee0e3da0c1023266ed33382dbe054d8c3fdd319
                            • Opcode Fuzzy Hash: 428e4268442bc8e5e936daba632dce075d974fe806ee7899692ebdab53b6c5b0
                            • Instruction Fuzzy Hash: 8121F4701587818BD724CF64C8947AAB7BAAF46305F544E1DC0AE4BE90DB7CA4498F52
                            Function 6CCA5120 Relevance: 3.1, APIs: 2, Instructions: 72COMMON
                            Download Yara Rule
                            APIs
                            • OpenSCManagerA.SECHOST(00000000,00000000,00000001), ref: 6CCA5130
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ManagerOpen
                            • String ID:
                            • API String ID: 1889721586-0
                            • Opcode ID: e6725481a4d73161559bc252a186be919611d0f9c8f049ad3ba4dd591e3b832f
                            • Instruction ID: 01d2e9267b2d02c6581497e307adc97d24ec9b2da8ea6d5f1b6fb23b77209560
                            • Opcode Fuzzy Hash: e6725481a4d73161559bc252a186be919611d0f9c8f049ad3ba4dd591e3b832f
                            • Instruction Fuzzy Hash: 9D3149B4608302EFC7108F69D548A5EBBF0FB89754F54895AFA88C7360D731C8459B53
                            Function 6CC9AEC0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON
                            Download Yara Rule
                            APIs
                            • FindFirstFileA.KERNEL32(?,?), ref: 6CC9AEDC
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: FileFindFirst
                            • String ID:
                            • API String ID: 1974802433-0
                            • Opcode ID: 7da1f5e4ae5fc15e2bae00eed496efb867028d82ca9c4cb4c4d5ae0f6a23c72f
                            • Instruction ID: 8a1e2010771a061ab3024ee33fa76876dfd29198db893b38a9c2b7b7cf62d16a
                            • Opcode Fuzzy Hash: 7da1f5e4ae5fc15e2bae00eed496efb867028d82ca9c4cb4c4d5ae0f6a23c72f
                            • Instruction Fuzzy Hash: 651148B4908390AFDB108F29D54450EBBE4BFC6314F148E59F4AACB791E370CC858B22
                            Function 6CC7AA30 Relevance: 44.5, APIs: 3, Strings: 22, Instructions: 734fileCOMMON
                            Download Yara Rule
                            APIs
                            • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 6CC7ABA7
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: FileRead
                            • String ID: $53N!$53N!$H$I_#]$J_#]$J_#]$Y<Uq$Y<Uq$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$f@n`$f@n`$jinc$|
                            • API String ID: 2738559852-1563143607
                            • Opcode ID: 36c714489a6da7fafc0fb9edeb6892bc4d0b3c1532fa63d71cf03b1f06d857c0
                            • Instruction ID: f0aaa779fe1daf71204b50e3847e3066ff05daa835256c5a7f2fe89af0dedc36
                            • Opcode Fuzzy Hash: 36c714489a6da7fafc0fb9edeb6892bc4d0b3c1532fa63d71cf03b1f06d857c0
                            • Instruction Fuzzy Hash: E262477060D3818FC724CF29C490A5ABBE2FBD9304F249D1EE999CB751E735D8858B62
                            Function 6CCBCAD3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 6824 6ccbcad3-6ccbcae3 6825 6ccbcafd-6ccbcaff 6824->6825 6826 6ccbcae5-6ccbcaf8 call 6ccaf9df call 6ccaf9cc 6824->6826 6828 6ccbcb05-6ccbcb0b 6825->6828 6829 6ccbce64-6ccbce71 call 6ccaf9df call 6ccaf9cc 6825->6829 6842 6ccbce7c 6826->6842 6828->6829 6832 6ccbcb11-6ccbcb37 6828->6832 6847 6ccbce77 call 6ccb0120 6829->6847 6832->6829 6835 6ccbcb3d-6ccbcb46 6832->6835 6838 6ccbcb48-6ccbcb5b call 6ccaf9df call 6ccaf9cc 6835->6838 6839 6ccbcb60-6ccbcb62 6835->6839 6838->6847 6840 6ccbcb68-6ccbcb6b 6839->6840 6841 6ccbce60-6ccbce62 6839->6841 6840->6841 6845 6ccbcb71-6ccbcb75 6840->6845 6846 6ccbce7f-6ccbce82 6841->6846 6842->6846 6845->6838 6849 6ccbcb77-6ccbcb8e 6845->6849 6847->6842 6853 6ccbcbdf-6ccbcbe5 6849->6853 6854 6ccbcb90-6ccbcb93 6849->6854 6855 6ccbcbab-6ccbcbc2 call 6ccaf9df call 6ccaf9cc call 6ccb0120 6853->6855 6856 6ccbcbe7-6ccbcbf1 6853->6856 6857 6ccbcba3-6ccbcba9 6854->6857 6858 6ccbcb95-6ccbcb9e 6854->6858 6891 6ccbcd97 6855->6891 6859 6ccbcbf8-6ccbcc16 call 6ccb47f5 call 6ccb47bb * 2 6856->6859 6860 6ccbcbf3-6ccbcbf5 6856->6860 6857->6855 6862 6ccbcbc7-6ccbcbda 6857->6862 6861 6ccbcc63-6ccbcc73 6858->6861 6895 6ccbcc18-6ccbcc2e call 6ccaf9cc call 6ccaf9df 6859->6895 6896 6ccbcc33-6ccbcc5c call 6ccbac69 6859->6896 6860->6859 6864 6ccbcc79-6ccbcc85 6861->6864 6865 6ccbcd38-6ccbcd41 call 6ccc19e5 6861->6865 6862->6861 6864->6865 6868 6ccbcc8b-6ccbcc8d 6864->6868 6879 6ccbcd43-6ccbcd55 6865->6879 6880 6ccbcdb4 6865->6880 6868->6865 6872 6ccbcc93-6ccbccb7 6868->6872 6872->6865 6876 6ccbccb9-6ccbcccf 6872->6876 6876->6865 6882 6ccbccd1-6ccbccd3 6876->6882 6879->6880 6881 6ccbcd57-6ccbcd66 GetConsoleMode 6879->6881 6884 6ccbcdb8-6ccbcdd0 ReadFile 6880->6884 6881->6880 6886 6ccbcd68-6ccbcd6c 6881->6886 6882->6865 6887 6ccbccd5-6ccbccfb 6882->6887 6889 6ccbce2c-6ccbce37 GetLastError 6884->6889 6890 6ccbcdd2-6ccbcdd8 6884->6890 6886->6884 6892 6ccbcd6e-6ccbcd88 ReadConsoleW 6886->6892 6887->6865 6894 6ccbccfd-6ccbcd13 6887->6894 6897 6ccbce39-6ccbce4b call 6ccaf9cc call 6ccaf9df 6889->6897 6898 6ccbce50-6ccbce53 6889->6898 6890->6889 6899 6ccbcdda 6890->6899 6893 6ccbcd9a-6ccbcda4 call 6ccb47bb 6891->6893 6902 6ccbcd8a GetLastError 6892->6902 6903 6ccbcda9-6ccbcdb2 6892->6903 6893->6846 6894->6865 6907 6ccbcd15-6ccbcd17 6894->6907 6895->6891 6896->6861 6897->6891 6904 6ccbce59-6ccbce5b 6898->6904 6905 6ccbcd90-6ccbcd96 call 6ccaf9f2 6898->6905 6901 6ccbcddd-6ccbcdef 6899->6901 6901->6893 6912 6ccbcdf1-6ccbcdf5 6901->6912 6902->6905 6903->6901 6904->6893 6905->6891 6907->6865 6915 6ccbcd19-6ccbcd33 6907->6915 6918 6ccbce0e-6ccbce19 6912->6918 6919 6ccbcdf7-6ccbce07 call 6ccbcefe 6912->6919 6915->6865 6924 6ccbce1b call 6ccbce83 6918->6924 6925 6ccbce25-6ccbce2a call 6ccbd1b6 6918->6925 6930 6ccbce0a-6ccbce0c 6919->6930 6931 6ccbce20-6ccbce23 6924->6931 6925->6931 6930->6893 6931->6930
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: 8Q
                            • API String ID: 0-4022487301
                            • Opcode ID: 6cb78687d4a77b670d3ffc5bacccbe95862fa4f0893531716a86617ae33dc2ed
                            • Instruction ID: 0ebc7aebeacf763570bd65d2bbe999aaefc6bfa97dbbf6c4a28b12a711cb6ab4
                            • Opcode Fuzzy Hash: 6cb78687d4a77b670d3ffc5bacccbe95862fa4f0893531716a86617ae33dc2ed
                            • Instruction Fuzzy Hash: DEC1F374E04249AFDF01DFE9C880BADBBB4BF4A318F104199E550BBB81E7709945CB65
                            Function 6CCC406C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 6933 6ccc406c-6ccc409c call 6ccc44ec 6936 6ccc409e-6ccc40a9 call 6ccaf9df 6933->6936 6937 6ccc40b7-6ccc40c3 call 6ccc160c 6933->6937 6942 6ccc40ab-6ccc40b2 call 6ccaf9cc 6936->6942 6943 6ccc40dc-6ccc4125 call 6ccc4457 6937->6943 6944 6ccc40c5-6ccc40da call 6ccaf9df call 6ccaf9cc 6937->6944 6953 6ccc4391-6ccc4395 6942->6953 6951 6ccc4127-6ccc4130 6943->6951 6952 6ccc4192-6ccc419b GetFileType 6943->6952 6944->6942 6956 6ccc4167-6ccc418d GetLastError call 6ccaf9f2 6951->6956 6957 6ccc4132-6ccc4136 6951->6957 6958 6ccc419d-6ccc41ce GetLastError call 6ccaf9f2 CloseHandle 6952->6958 6959 6ccc41e4-6ccc41e7 6952->6959 6956->6942 6957->6956 6962 6ccc4138-6ccc4165 call 6ccc4457 6957->6962 6958->6942 6970 6ccc41d4-6ccc41df call 6ccaf9cc 6958->6970 6960 6ccc41e9-6ccc41ee 6959->6960 6961 6ccc41f0-6ccc41f6 6959->6961 6965 6ccc41fa-6ccc4248 call 6ccc17b0 6960->6965 6961->6965 6966 6ccc41f8 6961->6966 6962->6952 6962->6956 6976 6ccc424a-6ccc4256 call 6ccc4666 6965->6976 6977 6ccc4267-6ccc428f call 6ccc4710 6965->6977 6966->6965 6970->6942 6976->6977 6984 6ccc4258 6976->6984 6982 6ccc4294-6ccc42d5 6977->6982 6983 6ccc4291-6ccc4292 6977->6983 6986 6ccc42f6-6ccc4304 6982->6986 6987 6ccc42d7-6ccc42db 6982->6987 6985 6ccc425a-6ccc4262 call 6ccbb925 6983->6985 6984->6985 6985->6953 6989 6ccc438f 6986->6989 6990 6ccc430a-6ccc430e 6986->6990 6987->6986 6988 6ccc42dd-6ccc42f1 6987->6988 6988->6986 6989->6953 6990->6989 6993 6ccc4310-6ccc4343 CloseHandle call 6ccc4457 6990->6993 6996 6ccc4345-6ccc4371 GetLastError call 6ccaf9f2 call 6ccc171f 6993->6996 6997 6ccc4377-6ccc438b 6993->6997 6996->6997 6997->6989
                            APIs
                              • Part of subcall function 6CCC4457: CreateFileW.KERNEL32(00000000,00000000,?,6CCC4115,?,?,00000000,?,6CCC4115,00000000,0000000C), ref: 6CCC4474
                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCC4180
                            • __dosmaperr.LIBCMT ref: 6CCC4187
                            • GetFileType.KERNEL32(00000000), ref: 6CCC4193
                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCC419D
                            • __dosmaperr.LIBCMT ref: 6CCC41A6
                            • CloseHandle.KERNEL32(00000000), ref: 6CCC41C6
                            • CloseHandle.KERNEL32(6CCBB0D0), ref: 6CCC4313
                            • GetLastError.KERNEL32 ref: 6CCC4345
                            • __dosmaperr.LIBCMT ref: 6CCC434C
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                            • String ID: 8Q
                            • API String ID: 4237864984-4022487301
                            • Opcode ID: fda6a7cc47e806a10c9a912ce570768ec360a1867f0631c331ef874587ae80ba
                            • Instruction ID: 53161a386084faead58e5c2dd14d9dd300e0730641b6ec98bc64b49212335151
                            • Opcode Fuzzy Hash: fda6a7cc47e806a10c9a912ce570768ec360a1867f0631c331ef874587ae80ba
                            • Instruction Fuzzy Hash: 69A14732B045449FDF09CFB8D851BBE7BB1AB46328F188249E851EB781E7359816CB52
                            Function 6CC7C1E0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 183COMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7002 6cc7c1e0-6cc7c239 call 6cca6b70 7005 6cc7c260-6cc7c269 7002->7005 7006 6cc7c2b0-6cc7c2b5 7005->7006 7007 6cc7c26b-6cc7c270 7005->7007 7010 6cc7c2b7-6cc7c2bc 7006->7010 7011 6cc7c330-6cc7c335 7006->7011 7008 6cc7c272-6cc7c277 7007->7008 7009 6cc7c2f0-6cc7c2f5 7007->7009 7014 6cc7c372-6cc7c3df WriteFile 7008->7014 7015 6cc7c27d-6cc7c282 7008->7015 7018 6cc7c431-6cc7c448 WriteFile 7009->7018 7019 6cc7c2fb-6cc7c300 7009->7019 7016 6cc7c407-6cc7c41b 7010->7016 7017 6cc7c2c2-6cc7c2c7 7010->7017 7012 6cc7c33b-6cc7c340 7011->7012 7013 6cc7c489-6cc7c4b9 call 6ccab3a0 7011->7013 7021 6cc7c346-6cc7c36d 7012->7021 7022 6cc7c4be-6cc7c4c3 7012->7022 7013->7005 7023 6cc7c3e9-6cc7c3fd WriteFile 7014->7023 7015->7023 7024 6cc7c288-6cc7c28d 7015->7024 7025 6cc7c41f-6cc7c42c 7016->7025 7026 6cc7c2cd-6cc7c2d2 7017->7026 7027 6cc7c23b-6cc7c250 7017->7027 7029 6cc7c452-6cc7c47f call 6ccab920 ReadFile 7018->7029 7028 6cc7c306-6cc7c30b 7019->7028 7019->7029 7030 6cc7c253-6cc7c258 7021->7030 7022->7005 7032 6cc7c4c9-6cc7c4d7 7022->7032 7023->7016 7024->7005 7033 6cc7c28f-6cc7c2aa 7024->7033 7025->7005 7026->7005 7034 6cc7c2d4-6cc7c2e7 7026->7034 7027->7030 7028->7005 7036 6cc7c311-6cc7c32b 7028->7036 7029->7013 7030->7005 7033->7030 7034->7030 7036->7025
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: :uW$;uW$;uW$> 4!$> 4!
                            • API String ID: 0-4100612575
                            • Opcode ID: 52600eed9021a17e682a6248462d3275caa1a039190e02080835424f67ca01a5
                            • Instruction ID: 745434757c777eb3dec42b1251bfb1423c2f232ddd59f5b4dbf5ede65df060c9
                            • Opcode Fuzzy Hash: 52600eed9021a17e682a6248462d3275caa1a039190e02080835424f67ca01a5
                            • Instruction Fuzzy Hash: F37192B0209346AFD720DF55C480B6ABBF4FF8A708F10492EF494D7A51E771D8589BA2
                            Function 6CC7B730 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 605COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: K?Jo$K?Jo$`Rlx$7eO
                            • API String ID: 0-174837320
                            • Opcode ID: 4384ab63b1bff2792ef32e5b2f08b6c01110e4d7a31a45cfdfeed5fd9725634c
                            • Instruction ID: f1cb5bbd9e04a22da2407f05d25a3714dabc85766c3805d026234f89606560f9
                            • Opcode Fuzzy Hash: 4384ab63b1bff2792ef32e5b2f08b6c01110e4d7a31a45cfdfeed5fd9725634c
                            • Instruction Fuzzy Hash: 2D4235746093468FC764CF29C0A0A5ABBE1FF99314F248D1EE5A5C7B20E638D845CB63
                            Function 6CB24200 Relevance: 9.0, APIs: 3, Strings: 1, Instructions: 2005COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: ;T55
                            • API String ID: 0-2572755013
                            • Opcode ID: d41fff22ce9be948aa34747d33bb876371eadc5bda914cfb178e47e16d926d46
                            • Instruction ID: b7a409eab151730f4415d099976d3d57cda8177c6ce5961e4e79581d14d05472
                            • Opcode Fuzzy Hash: d41fff22ce9be948aa34747d33bb876371eadc5bda914cfb178e47e16d926d46
                            • Instruction Fuzzy Hash: D703D731645B418FC728CF28C8D0696B7E3EFD5324719CB6DC0AA4BA99D778B44ACB50
                            Function 6CCA4FF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62processCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7579 6cca4ff0-6cca5077 CreateProcessA 7580 6cca50ca-6cca50d3 7579->7580 7581 6cca50f0-6cca510b 7580->7581 7582 6cca50d5-6cca50da 7580->7582 7581->7580 7583 6cca50dc-6cca50e1 7582->7583 7584 6cca5080-6cca50c2 WaitForSingleObject CloseHandle * 2 7582->7584 7583->7580 7585 6cca50e3-6cca5118 7583->7585 7584->7580
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CreateProcess
                            • String ID: D
                            • API String ID: 963392458-2746444292
                            • Opcode ID: f394a3ef818748419b8f8503cde6a40a71313ac110462c9a882f73526a9da7df
                            • Instruction ID: d418af22175aee728517ffbde6c2827c754a0fd7fd4e1f5393cce799b5a1694c
                            • Opcode Fuzzy Hash: f394a3ef818748419b8f8503cde6a40a71313ac110462c9a882f73526a9da7df
                            • Instruction Fuzzy Hash: 513102708097418FE340DF69D19872EBBF0AB8A318F50AA1DF49986250E7B595898F43
                            Function 6CCBBC5E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177fileCOMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7587 6ccbbc5e-6ccbbc7a 7588 6ccbbe39 7587->7588 7589 6ccbbc80-6ccbbc82 7587->7589 7590 6ccbbe3b-6ccbbe3f 7588->7590 7591 6ccbbca4-6ccbbcc5 7589->7591 7592 6ccbbc84-6ccbbc97 call 6ccaf9df call 6ccaf9cc call 6ccb0120 7589->7592 7594 6ccbbccc-6ccbbcd2 7591->7594 7595 6ccbbcc7-6ccbbcca 7591->7595 7609 6ccbbc9c-6ccbbc9f 7592->7609 7594->7592 7597 6ccbbcd4-6ccbbcd9 7594->7597 7595->7594 7595->7597 7599 6ccbbcdb-6ccbbce7 call 6ccbac69 7597->7599 7600 6ccbbcea-6ccbbcfb call 6ccbbe40 7597->7600 7599->7600 7607 6ccbbcfd-6ccbbcff 7600->7607 7608 6ccbbd3c-6ccbbd4e 7600->7608 7610 6ccbbd01-6ccbbd09 7607->7610 7611 6ccbbd26-6ccbbd32 call 6ccbbeb1 7607->7611 7612 6ccbbd50-6ccbbd59 7608->7612 7613 6ccbbd95-6ccbbdb7 WriteFile 7608->7613 7609->7590 7614 6ccbbdcb-6ccbbdce 7610->7614 7615 6ccbbd0f-6ccbbd1c call 6ccbc25b 7610->7615 7623 6ccbbd37-6ccbbd3a 7611->7623 7619 6ccbbd5b-6ccbbd5e 7612->7619 7620 6ccbbd85-6ccbbd93 call 6ccbc2c3 7612->7620 7617 6ccbbdb9-6ccbbdbf GetLastError 7613->7617 7618 6ccbbdc2 7613->7618 7625 6ccbbdd1-6ccbbdd6 7614->7625 7631 6ccbbd1f-6ccbbd21 7615->7631 7617->7618 7624 6ccbbdc5-6ccbbdca 7618->7624 7626 6ccbbd60-6ccbbd63 7619->7626 7627 6ccbbd75-6ccbbd83 call 6ccbc487 7619->7627 7620->7623 7623->7631 7624->7614 7632 6ccbbdd8-6ccbbddd 7625->7632 7633 6ccbbe34-6ccbbe37 7625->7633 7626->7625 7634 6ccbbd65-6ccbbd73 call 6ccbc39e 7626->7634 7627->7623 7631->7624 7636 6ccbbe09-6ccbbe15 7632->7636 7637 6ccbbddf-6ccbbde4 7632->7637 7633->7590 7634->7623 7640 6ccbbe1c-6ccbbe2f call 6ccaf9cc call 6ccaf9df 7636->7640 7641 6ccbbe17-6ccbbe1a 7636->7641 7642 6ccbbdfd-6ccbbe04 call 6ccaf9f2 7637->7642 7643 6ccbbde6-6ccbbdf8 call 6ccaf9cc call 6ccaf9df 7637->7643 7640->7609 7641->7588 7641->7640 7642->7609 7643->7609
                            APIs
                              • Part of subcall function 6CCBBEB1: GetConsoleCP.KERNEL32(?,6CCBB0D0,?), ref: 6CCBBEF9
                            • WriteFile.KERNEL32(?,?,6CCC46EC,00000000,00000000,?,00000000,00000000,6CCC5AB6,00000000,00000000,?,00000000,6CCBB0D0,6CCC46EC,00000000), ref: 6CCBBDAF
                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,6CCC46EC,6CCBB0D0,00000000,?,?,?,?,00000000,?), ref: 6CCBBDB9
                            • __dosmaperr.LIBCMT ref: 6CCBBDFE
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ConsoleErrorFileLastWrite__dosmaperr
                            • String ID: 8Q
                            • API String ID: 251514795-4022487301
                            • Opcode ID: 607bf33b103f3e4d6bcc7e47375d22b3cdbf9d26020d0551b192c628ae02d239
                            • Instruction ID: db2cfc63171dfa870807a401711909b51c4e3333c3b98dbbf66674eb0ba57a81
                            • Opcode Fuzzy Hash: 607bf33b103f3e4d6bcc7e47375d22b3cdbf9d26020d0551b192c628ae02d239
                            • Instruction Fuzzy Hash: 9751C271A0020AAFEB01DFF9C8D0BEEBB79EF06318F140491E500B7A51F774A94587A1
                            Function 6CCA5B90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7654 6cca5b90-6cca5b9c 7655 6cca5b9e-6cca5ba9 7654->7655 7656 6cca5bdd 7654->7656 7658 6cca5bab-6cca5bbd 7655->7658 7659 6cca5bbf-6cca5bcc call 6cb701f0 call 6ccb0b18 7655->7659 7657 6cca5bdf-6cca5c57 7656->7657 7661 6cca5c59-6cca5c81 7657->7661 7662 6cca5c83-6cca5c89 7657->7662 7658->7659 7667 6cca5bd1-6cca5bdb 7659->7667 7661->7662 7664 6cca5c8a-6cca5d49 call 6cb72250 call 6cb72340 call 6cca9379 call 6cb6e010 call 6cca7088 7661->7664 7667->7657
                            APIs
                            • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CCA5D31
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Ios_base_dtorstd::ios_base::_
                            • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                            • API String ID: 323602529-1866435925
                            • Opcode ID: 8b43650201012ca6cf119be7079b13a78f8a8b2aaa03958c75e2c871fdd04929
                            • Instruction ID: baf73291b517a44daa3656d74b8bbd89b0034fa3c14fbc7c3ffdbecc84778b08
                            • Opcode Fuzzy Hash: 8b43650201012ca6cf119be7079b13a78f8a8b2aaa03958c75e2c871fdd04929
                            • Instruction Fuzzy Hash: EB5134B5900B408FD725CF29C485B97BBF1FB48318F008A6DD9964BB90E775B90ACB90
                            Function 6CCBB925 Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7699 6ccbb925-6ccbb939 call 6ccc15a2 7702 6ccbb93b-6ccbb93d 7699->7702 7703 6ccbb93f-6ccbb947 7699->7703 7704 6ccbb98d-6ccbb9ad call 6ccc171f 7702->7704 7705 6ccbb949-6ccbb950 7703->7705 7706 6ccbb952-6ccbb955 7703->7706 7716 6ccbb9bb 7704->7716 7717 6ccbb9af-6ccbb9b9 call 6ccaf9f2 7704->7717 7705->7706 7710 6ccbb95d-6ccbb971 call 6ccc15a2 * 2 7705->7710 7707 6ccbb973-6ccbb983 call 6ccc15a2 CloseHandle 7706->7707 7708 6ccbb957-6ccbb95b 7706->7708 7707->7702 7720 6ccbb985-6ccbb98b GetLastError 7707->7720 7708->7707 7708->7710 7710->7702 7710->7707 7718 6ccbb9bd-6ccbb9c0 7716->7718 7717->7718 7720->7704
                            APIs
                            • CloseHandle.KERNEL32(00000000,?,00000000,?,6CCC425F), ref: 6CCBB97B
                            • GetLastError.KERNEL32(?,00000000,?,6CCC425F), ref: 6CCBB985
                            • __dosmaperr.LIBCMT ref: 6CCBB9B0
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CloseErrorHandleLast__dosmaperr
                            • String ID:
                            • API String ID: 2583163307-0
                            • Opcode ID: a803e29a823a27541a3f63533675ee47dd56866c8fdc8abaeb3aa068e9b5dbc5
                            • Instruction ID: 9bdeaed51dfb2f7b8c81eb190c60e8ff7cfa3848e62d5430fdd7e44f8418a2f7
                            • Opcode Fuzzy Hash: a803e29a823a27541a3f63533675ee47dd56866c8fdc8abaeb3aa068e9b5dbc5
                            • Instruction Fuzzy Hash: FB010833F455205AD20016FBE8A57AE37B94FC3B3CF290259E916A7AC0FB70C8858351
                            Function 6CCB0B9C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 7944 6ccb0b9c-6ccb0ba7 7945 6ccb0ba9-6ccb0bbc call 6ccaf9cc call 6ccb0120 7944->7945 7946 6ccb0bbe-6ccb0bcb 7944->7946 7957 6ccb0c10-6ccb0c12 7945->7957 7948 6ccb0bcd-6ccb0be2 call 6ccb0cb9 call 6ccb873e call 6ccb9c60 call 6ccbb898 7946->7948 7949 6ccb0c06-6ccb0c0f call 6ccbae75 7946->7949 7963 6ccb0be7-6ccb0bec 7948->7963 7949->7957 7964 6ccb0bee-6ccb0bf1 7963->7964 7965 6ccb0bf3-6ccb0bf7 7963->7965 7964->7949 7965->7949 7966 6ccb0bf9-6ccb0c05 call 6ccb47bb 7965->7966 7966->7949
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: 8Q
                            • API String ID: 0-4022487301
                            • Opcode ID: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                            • Instruction ID: 1c3b69aea6e6d1a6cb905c36071aadc9ae8d5b80ad574e14fec6b9eb3783d1d8
                            • Opcode Fuzzy Hash: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                            • Instruction Fuzzy Hash: 6FF0F9B29016545EC6211AFA8E00BC732AC9F4237CF100715E875B3ED0FB70E40AC7A2
                            Function 6CCA5960 Relevance: 3.1, APIs: 2, Instructions: 108COMMON
                            Download Yara Rule
                            APIs
                            • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CCA5AB4
                            • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CCA5AF4
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Ios_base_dtorstd::ios_base::_
                            • String ID:
                            • API String ID: 323602529-0
                            • Opcode ID: d421591a86f85f9a0289377270ea2f77c57443b76105553474edf2a9bcd760ac
                            • Instruction ID: 407c1e44a2c9eb90cf17ef9b55f3b3afb70adb87362e0af8e2829257a18f0173
                            • Opcode Fuzzy Hash: d421591a86f85f9a0289377270ea2f77c57443b76105553474edf2a9bcd760ac
                            • Instruction Fuzzy Hash: FE513C71201B41DBD725CF65C889BE7B7F4BB04718F448A1CD4AA4BB91EB30B94ACB81
                            Function 6CCAEF3F Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(6CCD6DD8,0000000C), ref: 6CCAEF52
                            • ExitThread.KERNEL32 ref: 6CCAEF59
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ErrorExitLastThread
                            • String ID:
                            • API String ID: 1611280651-0
                            • Opcode ID: df8bdcbca614fac4bc8fbb22ba020acdbdb14bd8a1f8bd45755ceec679b92250
                            • Instruction ID: b0bcb88c353270902caf2019eaa6064d9b0e5706f802a7e06d2fd9e507b13e8f
                            • Opcode Fuzzy Hash: df8bdcbca614fac4bc8fbb22ba020acdbdb14bd8a1f8bd45755ceec679b92250
                            • Instruction Fuzzy Hash: D8F0AFB1A00605AFDB04EBF1D80DAAE3B78FF45315F244689E105A7B40FB306916CBA1
                            Function 6CCBAF72 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: __wsopen_s
                            • String ID:
                            • API String ID: 3347428461-0
                            • Opcode ID: 2939ae370d0635017f94ae685c6669bee8e34956a41a87e891abe07520792b2e
                            • Instruction ID: 26a48102289d17ec692590c307e5efbc2b9687629db93d37a686eb6a8a741a37
                            • Opcode Fuzzy Hash: 2939ae370d0635017f94ae685c6669bee8e34956a41a87e891abe07520792b2e
                            • Instruction Fuzzy Hash: 9C113A71A0420EAFCB05CF99E94599B7BF8EF49314F144499F809EB301E671E911CBA5
                            Function 6CCC3FFE Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: _free
                            • String ID:
                            • API String ID: 269201875-0
                            • Opcode ID: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                            • Instruction ID: 1012c68ed2576f98d2f8738795fc2a20b2daab412dd6128c22c355558136e0b5
                            • Opcode Fuzzy Hash: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                            • Instruction Fuzzy Hash: 4E012872D0115AAFCF02DFE88D00AEE7FB5AB08314F144165ED24A26A0E7318A65DB91
                            Function 6CCC4457 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • CreateFileW.KERNEL32(00000000,00000000,?,6CCC4115,?,?,00000000,?,6CCC4115,00000000,0000000C), ref: 6CCC4474
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CreateFile
                            • String ID:
                            • API String ID: 823142352-0
                            • Opcode ID: b1750f682697c591070b1be6424209bd7c656a1b5b72747c0ff50bda3d5c2829
                            • Instruction ID: 68c01c1884f41991e724257480af70ef028573f92ef8cd80d8bc8596695e2d2e
                            • Opcode Fuzzy Hash: b1750f682697c591070b1be6424209bd7c656a1b5b72747c0ff50bda3d5c2829
                            • Instruction Fuzzy Hash: 59D06C3210060DBBDF028F84DC06EDA3BBAFB88714F014010BA5856020C732E861EB90
                            Function 6CB77F40 Relevance: 1.5, APIs: 1, Instructions: 1COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                            • Instruction ID: 4b097c342f3fdef1dc31d13d569bcd8d14fcb7bccb0da75aace2620aa6c10421
                            • Opcode Fuzzy Hash: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                            • Instruction Fuzzy Hash:

                            Non-executed Functions

                            Function 6CCA1880 Relevance: 10.5, APIs: 3, Strings: 1, Instructions: 3538COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: _strlen
                            • String ID: g)''
                            • API String ID: 4218353326-3487984327
                            • Opcode ID: 8b95ac0b6a74469ed6906e052ff97c9c7f10700f99ec6b24b1e2895758b5c75a
                            • Instruction ID: 78b5f73f5775caba375fdce8dccda1258ed4c1117bb15f4d78e4425f9c2c05c9
                            • Opcode Fuzzy Hash: 8b95ac0b6a74469ed6906e052ff97c9c7f10700f99ec6b24b1e2895758b5c75a
                            • Instruction Fuzzy Hash: 40630331645B028FC728CF69C8D8A95B7F3BF853187198A6DC09A4BA55FB74B44BCB40
                            Function 6CCA5D60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 31nativeshutdownCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentProcess.KERNEL32 ref: 6CCA5D6A
                            • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 6CCA5D76
                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 6CCA5D84
                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 6CCA5DAB
                            • NtInitiatePowerAction.NTDLL ref: 6CCA5DBF
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ProcessToken$ActionAdjustCurrentInitiateLookupOpenPowerPrivilegePrivilegesValue
                            • String ID: SeShutdownPrivilege
                            • API String ID: 3256374457-3733053543
                            • Opcode ID: 36cb848f6f951b80e24555af1afcda7411144d6bff6f245520610183afbbf037
                            • Instruction ID: 705642dc872687555073d939f785a88ac6ab832ac50be58bcca15123fc5d4012
                            • Opcode Fuzzy Hash: 36cb848f6f951b80e24555af1afcda7411144d6bff6f245520610183afbbf037
                            • Instruction Fuzzy Hash: E7F05470A44304BBFA00AB64ED0EB9E7BF8EF45701F055518FA45A61D1EBB06994CB92
                            Function 6CB21950 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 594COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: \j`7$\j`7$j
                            • API String ID: 0-3644614255
                            • Opcode ID: 411a59a87ab21cd17681cfdcb0c8b32efd5e0331fb92c40ff59ee14231d2d77d
                            • Instruction ID: d60b17cbb3de630d43376cf88c06dc739e8c3da475dfa762db8fbc729d6ba494
                            • Opcode Fuzzy Hash: 411a59a87ab21cd17681cfdcb0c8b32efd5e0331fb92c40ff59ee14231d2d77d
                            • Instruction Fuzzy Hash: 334235746093828FCB24CF68C49066ABBE1BBCA354F184A1EE4D9D7760D739D846CB53
                            Function 6CD384AC Relevance: 8.7, APIs: 1, Strings: 3, Instructions: 1656COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CD384B1
                              • Part of subcall function 6CD3993B: __EH_prolog.LIBCMT ref: 6CD39940
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: 1$`)K$h)K
                            • API String ID: 3519838083-3935664338
                            • Opcode ID: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                            • Instruction ID: 4f1059b3eca8bf480216a75a4e87e82d0456b273c310745360f0ebb47af69dbf
                            • Opcode Fuzzy Hash: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                            • Instruction Fuzzy Hash: 58F27070D05258DFDB11CFA8C884BDDBBB5AF8A308F24409AD449EB761DB759A85CF20
                            Function 6CD2AEEF Relevance: 8.3, APIs: 1, Strings: 2, Instructions: 3058COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CD2AEF4
                              • Part of subcall function 6CD2E622: __EH_prolog.LIBCMT ref: 6CD2E627
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: $h%K
                            • API String ID: 3519838083-1737110039
                            • Opcode ID: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                            • Instruction ID: ff4efd0568c17ae54e88a2b3dc2c17eaa278893af8bde11fe60f44fbc8eac2ae
                            • Opcode Fuzzy Hash: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                            • Instruction Fuzzy Hash: 12539B30901258DFDB15CBA4C994BEDBBB0AF0930CF1440D9D54AA76A1DB78AE89CF61
                            Function 6CD3C7F3 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1546COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: $J
                            • API String ID: 3519838083-1755042146
                            • Opcode ID: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                            • Instruction ID: f5bb828b2ac0ef7bc7cf9c3955a0fc1f11de8b5b8dac1071710c8ecea6b261cd
                            • Opcode Fuzzy Hash: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                            • Instruction Fuzzy Hash: F9E2F270A05268DFEF01CFA8C448BDDBBB0AF46308F244199E859AB7A1DB74D945CF61
                            Function 6CD06CE0 Relevance: 5.4, APIs: 1, Strings: 1, Instructions: 1923COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CD06CE5
                              • Part of subcall function 6CCDCC2A: __EH_prolog.LIBCMT ref: 6CCDCC2F
                              • Part of subcall function 6CCDE6A6: __EH_prolog.LIBCMT ref: 6CCDE6AB
                              • Part of subcall function 6CD06A0E: __EH_prolog.LIBCMT ref: 6CD06A13
                              • Part of subcall function 6CD06837: __EH_prolog.LIBCMT ref: 6CD0683C
                              • Part of subcall function 6CD0A143: __EH_prolog.LIBCMT ref: 6CD0A148
                              • Part of subcall function 6CD0A143: ctype.LIBCPMT ref: 6CD0A16C
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog$ctype
                            • String ID:
                            • API String ID: 1039218491-3916222277
                            • Opcode ID: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                            • Instruction ID: 257f9b63fc665091cc6f496635283959ce87c4f16c674354193d3d39e495b851
                            • Opcode Fuzzy Hash: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                            • Instruction Fuzzy Hash: 0003C130905248EFDF15CFA8C850BDCBBB0AF15318F1540DAD5496B6A1EB74AB89CF61
                            Function 6CD5C580 Relevance: 5.2, Strings: 4, Instructions: 153COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: 3J$`/J$`1J$p0J
                            • API String ID: 0-2826663437
                            • Opcode ID: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                            • Instruction ID: e14e41f4c14ab13ff4c8f240d47f75118f4bec955656c1155d6d60e7ff047f07
                            • Opcode Fuzzy Hash: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                            • Instruction Fuzzy Hash: 3C412A71F109601AF3488F7A8C855667FC3C7C9346B4AC23DD565CB6E9EA7DC40782A4
                            Function 6CD30A52 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1212COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: W
                            • API String ID: 3519838083-655174618
                            • Opcode ID: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                            • Instruction ID: 4b7aa2f4d663611c5a56f2dc6fd5656f943c1bb6c0e7767e63d98ed998dd8698
                            • Opcode Fuzzy Hash: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                            • Instruction Fuzzy Hash: ACB25E74A05269DFDB01CFA8C588B9DBBB4BF4A308F244099E849EB761C775ED41CB60
                            Function 6CCB0181 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CCB0279
                            • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CCB0283
                            • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CCB0290
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                            • String ID:
                            • API String ID: 3906539128-0
                            • Opcode ID: 90569efd51b73a2058410bacc8f8f4220d035fd3207ed8e290abf0f9fbbeb1a6
                            • Instruction ID: 475d6bfa0412d34c12796e4805e73a3178c81262d603bc5518cde532efa34ac1
                            • Opcode Fuzzy Hash: 90569efd51b73a2058410bacc8f8f4220d035fd3207ed8e290abf0f9fbbeb1a6
                            • Instruction Fuzzy Hash: 5131C57590121D9BCB21DF68DD89BCDBBB8BF08314F5041DAE41DA7250EB709B858F45
                            Function 6CCAF17D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetCurrentProcess.KERNEL32(00000000,?,6CCAF235,6CCA9C49,00000003,00000000,6CCA9C49,00000000), ref: 6CCAF19F
                            • TerminateProcess.KERNEL32(00000000,?,6CCAF235,6CCA9C49,00000003,00000000,6CCA9C49,00000000), ref: 6CCAF1A6
                            • ExitProcess.KERNEL32 ref: 6CCAF1B8
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Process$CurrentExitTerminate
                            • String ID:
                            • API String ID: 1703294689-0
                            • Opcode ID: 660736dad771281ff290f090dcfb5d73701888c87fca4218eec4286f938e76a2
                            • Instruction ID: 4b6801d9b77c6c60a99a9cfa3551815824e60a411bf22257ce36293814c334cf
                            • Opcode Fuzzy Hash: 660736dad771281ff290f090dcfb5d73701888c87fca4218eec4286f938e76a2
                            • Instruction Fuzzy Hash: 48E0B632501108AFCF12AFA5D84CA8A3F79FB86356B114414FA59C6621EB35E982CB50
                            Function 6CD24896 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 333COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CD2489B
                              • Part of subcall function 6CD25FC9: __EH_prolog.LIBCMT ref: 6CD25FCE
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: @ K
                            • API String ID: 3519838083-4216449128
                            • Opcode ID: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                            • Instruction ID: d6b5084b585c5c28197216023efdc5de9d9ff7a5aa723560008c492993b7e5ec
                            • Opcode Fuzzy Hash: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                            • Instruction Fuzzy Hash: FCD10271D04204CFDB14CFA8C4907EEB7B6FF8431CF15812AEA15ABAA4DB789845CB25
                            Function 6CCD8EA1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: x=J
                            • API String ID: 3519838083-1497497802
                            • Opcode ID: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                            • Instruction ID: 4020bd126e7aad9068d4f247b5cdd890d495c36878d21e550d95564cb71a05ab
                            • Opcode Fuzzy Hash: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                            • Instruction Fuzzy Hash: 0991F435D011099ACF04DFA5D8A09EDF771BF45308F22806ED656A7A50FF31798ACB91
                            Function 6CCA6A43 Relevance: 3.3, APIs: 2, Instructions: 302COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CCA78B0
                            • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CCA80D3
                              • Part of subcall function 6CCA9379: RaiseException.KERNEL32(E06D7363,00000001,00000003,6CCA80BC,00000000,?,?,?,6CCA80BC,?,6CCD554C), ref: 6CCA93D9
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ExceptionFeaturePresentProcessorRaisestd::invalid_argument::invalid_argument
                            • String ID:
                            • API String ID: 915016180-0
                            • Opcode ID: 43b998ef4dc77ac4142a1cf793e3f80ff87bdc96d4e5d59e325f126426a984a1
                            • Instruction ID: 874d76a2ba1d77c26828f7407b637bf1c87d7119b7eb7f99347a447147f59314
                            • Opcode Fuzzy Hash: 43b998ef4dc77ac4142a1cf793e3f80ff87bdc96d4e5d59e325f126426a984a1
                            • Instruction Fuzzy Hash: 4CB1ED71E052069FEB05CFD8D885A9DBBB9FB09318F24822ED612E7680E374D945CF90
                            Function 6CD42521 Relevance: 2.6, APIs: 1, Instructions: 1105COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID:
                            • API String ID: 3519838083-0
                            • Opcode ID: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                            • Instruction ID: 7d6198d97d4b0dc54c714249cf728e06316ca8e5fa8ce3680ca105d6167cef0b
                            • Opcode Fuzzy Hash: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                            • Instruction Fuzzy Hash: 33B2BB30904758CFDB21CF69C484BDEBBF1BF05308F108699D69AA7AA1D770A989CF51
                            Function 6CCD8972 Relevance: 2.6, Strings: 2, Instructions: 91COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: @4J$DsL
                            • API String ID: 0-2004129199
                            • Opcode ID: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                            • Instruction ID: 0ad3b0e7b7f699f0e87bddb88b7d07fa24fd6402268f60197a3f09933bf22255
                            • Opcode Fuzzy Hash: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                            • Instruction Fuzzy Hash: 332191376A49564BD74CCA28EC33EB92681E744305B89527EE94BCB3E1DF6D8800C649
                            Function 6CD767C0 Relevance: 1.7, Strings: 1, Instructions: 468COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: @
                            • API String ID: 0-2766056989
                            • Opcode ID: f76254a8391bbbc56ee5761849d9b464ca1ca2a3d131f1b477d5a7e0a80fcda2
                            • Instruction ID: 440d290898431e93a5a9289f56aef2eac903b34d7ee170d3167cca6528f17237
                            • Opcode Fuzzy Hash: f76254a8391bbbc56ee5761849d9b464ca1ca2a3d131f1b477d5a7e0a80fcda2
                            • Instruction Fuzzy Hash: FB12F6B29083158FC358DF4AD44045BF7E2BFC8714F1A8A6EF898A7311D770E9568B86
                            Function 6CCE0BCA Relevance: 1.7, APIs: 1, Instructions: 201COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: __aullrem
                            • String ID:
                            • API String ID: 3758378126-0
                            • Opcode ID: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                            • Instruction ID: 98ad4c8a381016c74c73d47025c467acade62a64f8efa2ed41555105ca679396
                            • Opcode Fuzzy Hash: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                            • Instruction Fuzzy Hash: AE51FA71A043859BD710CF5AC4C12EEFBF6EF7A214F14C05EE8C897242E27A599AC760
                            Function 6CD76999 Relevance: 1.6, Strings: 1, Instructions: 324COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: @
                            • API String ID: 0-2766056989
                            • Opcode ID: b4ce60841bca8fd945d7956f1acfe73c36a86ce5a82225692ce6a5b8030d2b38
                            • Instruction ID: 77b824726e15996d2f0c9bfd4d96eebb96ea59e3e70a0a5c7a74a19e5e9ba9ed
                            • Opcode Fuzzy Hash: b4ce60841bca8fd945d7956f1acfe73c36a86ce5a82225692ce6a5b8030d2b38
                            • Instruction Fuzzy Hash: 23D13E729083148FC758DF4AD44005BF7E2BFC8314F1A892EF899A7315DB70A9568BC6
                            Function 6CCDC7CF Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: (SL
                            • API String ID: 0-669240678
                            • Opcode ID: 403d64dc1b872b29255918294ce527b86f393edeaddcf848938bb8168c435548
                            • Instruction ID: 3e7a72f85a332ebff40557b844ac744121496d4cf41359da7f537c8c2a69db25
                            • Opcode Fuzzy Hash: 403d64dc1b872b29255918294ce527b86f393edeaddcf848938bb8168c435548
                            • Instruction Fuzzy Hash: B0518373E208214AD79CCF24DC2177572D2E784310F8BC1B99D8BAB6E6D978A89087D4
                            Function 6CD4AB90 Relevance: .9, Instructions: 940COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                            • Instruction ID: a414d6a2228e66b489e636bb521381fb6cd8ca614b6a7e7a8f7a839fe83f25e4
                            • Opcode Fuzzy Hash: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                            • Instruction Fuzzy Hash: 01728CB16046168FD748CF28C490258FBE1FF89314B5A86BDD95ADB792DB30E895CBC0
                            Function 6CD6A930 Relevance: .7, Instructions: 740COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                            • Instruction ID: f7a353b892c815b5381d64d18397815f99a0a402256693c8d587cfbea7de89d0
                            • Opcode Fuzzy Hash: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                            • Instruction Fuzzy Hash: 9F62F2B1A08355DFC714CF1AC58061ABBE1BFC8748F248A2EF89987B65D770E845CB52
                            Function 6CD68950 Relevance: .7, Instructions: 697COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                            • Instruction ID: 5106c83adc3f780da539219fae61727cba1d2025f309f222074e4ff4e8868dba
                            • Opcode Fuzzy Hash: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                            • Instruction Fuzzy Hash: 38426171604B058FD324CF6AC8907ABB7E2FB88314F444A2EE896C7BA4D774E549CB51
                            Function 6CD64489 Relevance: .5, Instructions: 519COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: dc8004adaa3259f52bc6ab735d8be8844deca4391a1dba6202427b66ce1407bc
                            • Instruction ID: 28d623d6bcf5438654c1f6b43498573c81f38d49cdf0b00be59dacdb3b6b7392
                            • Opcode Fuzzy Hash: dc8004adaa3259f52bc6ab735d8be8844deca4391a1dba6202427b66ce1407bc
                            • Instruction Fuzzy Hash: 7102C7B3A4835147D715CF1EC890219B7E3FBC1390F5A4A2EE8D647BA4DBB09946CB81
                            Function 6CD64AA0 Relevance: .5, Instructions: 474COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                            • Instruction ID: 5e547b63baf15bc2a99f8ff89fcd1d32a0699a9375f434d25bd7efaf9f5534d6
                            • Opcode Fuzzy Hash: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                            • Instruction Fuzzy Hash: 8302E772A083118BD319CF2DC4A0269BBF2FBC4355F154B2EE49697EA4D774D884CB92
                            Function 6CD6E600 Relevance: .5, Instructions: 470COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                            • Instruction ID: 8446902983eede6d8d3a54ad122c971c488dd68753a0702f2dce07220b955795
                            • Opcode Fuzzy Hash: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                            • Instruction Fuzzy Hash: B212C070604B618FC328CF2EC490666FBF2AF85305F188A6ED1D687EA5D735E548CB91
                            Function 6CD56D10 Relevance: .4, Instructions: 429COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                            • Instruction ID: 9cc6b3c6ed4094e1e3e3f5af8fc02f8989cc54ed3e9b223d890086b8fc31c9b4
                            • Opcode Fuzzy Hash: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                            • Instruction Fuzzy Hash: 1EE1F071704B008BEB24CF28D4603AEB7E2EBC4314FA4892DC596C7B91DB75E51ACB91
                            Function 6CD6EBC0 Relevance: .4, Instructions: 399COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                            • Instruction ID: de18d0a469464ddb741af972ccc170a7f71b8053c4e177c12e4d267b7bb5d250
                            • Opcode Fuzzy Hash: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                            • Instruction Fuzzy Hash: B1F1B270608B518FC328CF2ED894266FBE1AF89304F184A6ED1D6C7EA1D339E554CB91
                            Function 6CD6C8D0 Relevance: .4, Instructions: 383COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                            • Instruction ID: 455b56bb892012b82d2325767c81d3934dd14d3a95d537f7598f6bcb5fae3f77
                            • Opcode Fuzzy Hash: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                            • Instruction Fuzzy Hash: 95F1CF705087A18BC729DF2AC49026AFBF1BFC5304F188A2ED5DA86BA1D339E155CB51
                            Function 6CD56900 Relevance: .3, Instructions: 341COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                            • Instruction ID: 677eec58e8490009928db4f0c75c37fe5c90b8b2c193779f73fdd863672113b1
                            • Opcode Fuzzy Hash: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                            • Instruction Fuzzy Hash: DFC1C475604B068BE728CF29C4905AEB7E2FBC4314F948A2DC596C7B55D730F4A6CB81
                            Function 6CD74DE0 Relevance: .3, Instructions: 333COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ec689b497c358338b72b358a92d889533f653208c8e8c7d7476938d601be6615
                            • Instruction ID: 131838f3fb27bb7d171c6aa97a27489b35e99380a219fa95a4f6d4fea23d1af4
                            • Opcode Fuzzy Hash: ec689b497c358338b72b358a92d889533f653208c8e8c7d7476938d601be6615
                            • Instruction Fuzzy Hash: 81E1E6B18047A64FE398EF5CDCA4A3577A1EBC8300F4B427DDA650B392D734A942DB94
                            Function 6CD52580 Relevance: .3, Instructions: 316COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                            • Instruction ID: 52cc78967ab6d0d207a42307ebab18c6411294b386e273a0f77534636cf2a142
                            • Opcode Fuzzy Hash: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                            • Instruction Fuzzy Hash: 9BC1C2352047418BC718DF39D0A46A7BBE2EFDA318F548A6DC4CA4BB66DB30A40DCB55
                            Function 6CD5E4D0 Relevance: .3, Instructions: 307COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                            • Instruction ID: 38d00a096d3554cdc0c71c7e18791ba49670239b8778402109ca02fdacb16921
                            • Opcode Fuzzy Hash: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                            • Instruction Fuzzy Hash: 3AB193716052508FC740EF29C484244BBA2FF8536CBB9569EC4948FA56E33BD857CBD1
                            Function 6CD74870 Relevance: .3, Instructions: 298COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1abcbd09df316e1226b3bd6821a11b0a668bf7f1b83a95c986258978a9b95a2f
                            • Instruction ID: 5dacd0f1486866c6563e249b407938d43566a8619b34a148834a78725836bc4d
                            • Opcode Fuzzy Hash: 1abcbd09df316e1226b3bd6821a11b0a668bf7f1b83a95c986258978a9b95a2f
                            • Instruction Fuzzy Hash: 22D1F8B1848B9A5FD394EF4DEC81A357762AF88301F4A8239DB6007753D634BB12D794
                            Function 6CD4E810 Relevance: .3, Instructions: 296COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                            • Instruction ID: 823ae794d766ef7bee9226f9e0fc8b4f30ac15ca77af811b0010ff1e27de7d74
                            • Opcode Fuzzy Hash: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                            • Instruction Fuzzy Hash: 9CB1D331304B059BD324DF39C8907EAF3E1AF85308F04852DD69A87BA1EF30A509C7A5
                            Function 6CD545D0 Relevance: .2, Instructions: 224COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                            • Instruction ID: 3c3026ddd1c246328810c75cefea1b0936c61401d2c7743fd00b40dfdd1d6bb3
                            • Opcode Fuzzy Hash: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                            • Instruction Fuzzy Hash: BB6150B2308215CFD708CFA9E180A96B3E5EB99321B5686BFD105CB361E771DC61CB58
                            Function 6CD68520 Relevance: .2, Instructions: 216COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                            • Instruction ID: d82279e04231b299b3fae54f2b66a620066abab1ec82e6a364460ceb99daaacd
                            • Opcode Fuzzy Hash: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                            • Instruction Fuzzy Hash: 889191B2C1871A8BD314CF18C88025AB7E0FB88308F45067DED9A97351D775EA55CBC5
                            Function 6CCF0B66 Relevance: .2, Instructions: 167COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                            • Instruction ID: aa353b3be3ab910374032e8a9ca5c1e9ec53edf49290b01c926aa5c68a063c9c
                            • Opcode Fuzzy Hash: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                            • Instruction Fuzzy Hash: 3F519F72F006099BDB48CF98DDA16ADBBF1EF88704F24816DD521E7781E7749A42CB50
                            Function 6CCF2EC9 Relevance: .1, Instructions: 136COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                            • Instruction ID: 83c5978b16d251d7835dd16d1f1ea049f4ab70858637d143fc49f0f7da490c9e
                            • Opcode Fuzzy Hash: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                            • Instruction Fuzzy Hash: 5F3114277A484103D74CCA2BCC2679F91535BD422A75ECB396815DAF55E52CC8134144
                            Function 6CD5EEF0 Relevance: .1, Instructions: 123COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                            • Instruction ID: a74fd699222f538581c71933e314b981a0b1a27fa222948f498e304d24855410
                            • Opcode Fuzzy Hash: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                            • Instruction Fuzzy Hash: A5316CB3504A058AFA00972DC9403167263DBC23A9FED8365D9668BEFCCE7694278180
                            Function 6CD66820 Relevance: .1, Instructions: 112COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                            • Instruction ID: 0d2f44f64b8270b0517c7b796836ed68d0b6db832b12f5e9ad38941cb91e79c0
                            • Opcode Fuzzy Hash: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                            • Instruction Fuzzy Hash: 3441AEB29047068BD704CF19C89056AB3E4FF88318F454A2DED5AA7791E330EA25CBD1
                            Function 6CD746C0 Relevance: .1, Instructions: 88COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d2e9eb99358111aa00ddd4771d36b21c13931b70b848b90c87e332bda565fdca
                            • Instruction ID: c892a6df20eb1233b501dd95b61e6fc5d648cf6426276cf7025a6bbae2a57748
                            • Opcode Fuzzy Hash: d2e9eb99358111aa00ddd4771d36b21c13931b70b848b90c87e332bda565fdca
                            • Instruction Fuzzy Hash: 6E2148B1A047E647E7219E6DCCC037577D2ABC2305F09427DDAA08FA87D17984A2DAA0
                            Function 6CD7A91A Relevance: .1, Instructions: 73COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2f6c02fb19c880906673f7e2ee61692b55198f776a78d908325c4e40f91ba080
                            • Instruction ID: 0e2466fec530011e985f4106deff7cf217a17b659fde9f6e1a0d0391a5f7fbb7
                            • Opcode Fuzzy Hash: 2f6c02fb19c880906673f7e2ee61692b55198f776a78d908325c4e40f91ba080
                            • Instruction Fuzzy Hash: 6A21377251542587C311DF2DE888677B3E1FFC431DFA38A2AD9968B591C734D450C6A0
                            Function 6CD7AA00 Relevance: .1, Instructions: 73COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d76c5a5bc13364a97e7cc912041d9df0cf3f333301463df377c6d5e010c89ef9
                            • Instruction ID: 6022ae0870622de40d0567b640f90471b9978259c0bc7d4bb163f70b8cf77ced
                            • Opcode Fuzzy Hash: d76c5a5bc13364a97e7cc912041d9df0cf3f333301463df377c6d5e010c89ef9
                            • Instruction Fuzzy Hash: 3B2102326021148FCB01EF6AD9C469B73E6EFC8365F67C63EED8547644C630E60687A0
                            Function 6CCB9D66 Relevance: .0, Instructions: 29COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 99e86424fe026d7fc9674b654ecf859dfbaed426daa51bb67dd76828ae11451b
                            • Instruction ID: 2d0fff780a376f78a75320f095c979a09dd231c8071a82d3458a5f85d454beab
                            • Opcode Fuzzy Hash: 99e86424fe026d7fc9674b654ecf859dfbaed426daa51bb67dd76828ae11451b
                            • Instruction Fuzzy Hash: 07F0A932A14620ABCB16DBD9C801B89B3BCEB45B66F110096E504EB640E3B0EE00CBC0
                            Function 6CCB9D35 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1cade3b8bd37eadd8f509832e5cf264ebb44d36771f29a864de074982515b943
                            • Instruction ID: 3015731a6eb38afe517d270a0369587d8fcad572b95e8f99808d87be6fd645b2
                            • Opcode Fuzzy Hash: 1cade3b8bd37eadd8f509832e5cf264ebb44d36771f29a864de074982515b943
                            • Instruction Fuzzy Hash: 5DE08C72A12238EBCB15EBE9C900D8AB7FCEB44A05B1140DAF501E3610E270DE00C7D0
                            Function 6CD0EB50 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 341COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: @$p&L$p&L$p&L$p&L$p&L$p&L$p&L$p&L
                            • API String ID: 3519838083-609671
                            • Opcode ID: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                            • Instruction ID: 754c490452087156e52d340d1159f0ff882f0fd82635104bc043f75b406cd85b
                            • Opcode Fuzzy Hash: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                            • Instruction Fuzzy Hash: F1D1C771B04209DFCB11CFA8D990BEEB7B5FF05308F244559E195A3E60EB71A948CBA4
                            Function 6CCA9AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON
                            Download Yara Rule
                            APIs
                            • _ValidateLocalCookies.LIBCMT ref: 6CCA9B07
                            • ___except_validate_context_record.LIBVCRUNTIME ref: 6CCA9B0F
                            • _ValidateLocalCookies.LIBCMT ref: 6CCA9B98
                            • __IsNonwritableInCurrentImage.LIBCMT ref: 6CCA9BC3
                            • _ValidateLocalCookies.LIBCMT ref: 6CCA9C18
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                            • String ID: csm
                            • API String ID: 1170836740-1018135373
                            • Opcode ID: 4dd635aa0252c2850a6b4e10cb405f077d5b15d142dc5a35ad3341273e564231
                            • Instruction ID: e70b07b432a86249dbc76e47132ac62807cf424e93f943e04e300eea0758500e
                            • Opcode Fuzzy Hash: 4dd635aa0252c2850a6b4e10cb405f077d5b15d142dc5a35ad3341273e564231
                            • Instruction Fuzzy Hash: FF41E830E1011A9FCF10DFE8D889ADEBBB5BF46318F108155D815ABB51E732DA46CB90
                            Function 6CCB6E9A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: api-ms-$ext-ms-
                            • API String ID: 0-537541572
                            • Opcode ID: 33f46e67bb2152e09e84fc06e9682d71a7ca76e56b61f6aaa75e6dbf76dacdfa
                            • Instruction ID: 8d51d4d14ca85b402da827dfb76ba93b806264cb4ddd0c4cd338a744290f75c7
                            • Opcode Fuzzy Hash: 33f46e67bb2152e09e84fc06e9682d71a7ca76e56b61f6aaa75e6dbf76dacdfa
                            • Instruction Fuzzy Hash: DA21DB32E16A11ABDB158BE9DC40B4A3778AB47768F250661F955F7A80F730ED01C6E0
                            Function 6CCBBEB1 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetConsoleCP.KERNEL32(?,6CCBB0D0,?), ref: 6CCBBEF9
                            • __fassign.LIBCMT ref: 6CCBC0D8
                            • __fassign.LIBCMT ref: 6CCBC0F5
                            • WriteFile.KERNEL32(?,6CCC5AB6,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCBC13D
                            • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CCBC17D
                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCBC229
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: FileWrite__fassign$ConsoleErrorLast
                            • String ID:
                            • API String ID: 4031098158-0
                            • Opcode ID: 1a707413d46a669b8c47ee6e9fe835731a696dc9b38449d14e2292ae52597f64
                            • Instruction ID: df8049de2a1e636d27263072eae3eb66dadf62c235b533f9e75151f8308fbaf1
                            • Opcode Fuzzy Hash: 1a707413d46a669b8c47ee6e9fe835731a696dc9b38449d14e2292ae52597f64
                            • Instruction Fuzzy Hash: BED19875E016589FDF15CFE8C8809EDBBB5BF49314F28016AE865FB241E731AA06CB50
                            Function 6CB72F60 Relevance: 9.1, APIs: 6, Instructions: 107COMMON
                            Download Yara Rule
                            APIs
                            • std::_Lockit::_Lockit.LIBCPMT ref: 6CB72F95
                            • std::_Lockit::_Lockit.LIBCPMT ref: 6CB72FAF
                            • std::_Lockit::~_Lockit.LIBCPMT ref: 6CB72FD0
                            • __Getctype.LIBCPMT ref: 6CB73084
                            • std::_Facet_Register.LIBCPMT ref: 6CB7309C
                            • std::_Lockit::~_Lockit.LIBCPMT ref: 6CB730B7
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
                            • String ID:
                            • API String ID: 1102183713-0
                            • Opcode ID: 2014b4f89ad87060c56d6e3a8106f475639450bb1463c08762e4121686f3da4c
                            • Instruction ID: acdc61c9cf0aa713ad4b724cf323885cae91b9691cee61bf23bea23f64e37cd2
                            • Opcode Fuzzy Hash: 2014b4f89ad87060c56d6e3a8106f475639450bb1463c08762e4121686f3da4c
                            • Instruction Fuzzy Hash: 44416871E006958FDF20CF98D858B9EB7B4FB44714F058118D929AB780EB34A905CFE2
                            Function 6CCE4FA6 Relevance: 9.1, APIs: 6, Instructions: 95COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: __aulldiv$__aullrem
                            • String ID:
                            • API String ID: 2022606265-0
                            • Opcode ID: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                            • Instruction ID: 0c914d8b951bfc627db8ac855bb1c0cb0958d01b9c840b0416aef28de52caa21
                            • Opcode Fuzzy Hash: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                            • Instruction Fuzzy Hash: 77218D30901219BFDF219F948C44DDF7E79FF4A7A8F20862AB524616E0E2B18D51C6B1
                            Function 6CCEA6EC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 183COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CCEA6F1
                              • Part of subcall function 6CCF9173: __EH_prolog.LIBCMT ref: 6CCF9178
                            • __EH_prolog.LIBCMT ref: 6CCEA8F9
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: IJ$WIJ$J
                            • API String ID: 3519838083-740443243
                            • Opcode ID: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                            • Instruction ID: e746faf0deacea848679267833a6c90e13b98a8c05725cdd9e477351f4bde642
                            • Opcode Fuzzy Hash: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                            • Instruction Fuzzy Hash: 9271E230900244DFDB14CF65C440BDDBBF0BF59308F1180A9D85AABB91EB74BA49CBA5
                            Function 6CCC5A0D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132fileCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • _free.LIBCMT ref: 6CCC5ADD
                            • _free.LIBCMT ref: 6CCC5B06
                            • SetEndOfFile.KERNEL32(00000000,6CCC46EC,00000000,6CCBB0D0,?,?,?,?,?,?,?,6CCC46EC,6CCBB0D0,00000000), ref: 6CCC5B38
                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,6CCC46EC,6CCBB0D0,00000000,?,?,?,?,00000000,?), ref: 6CCC5B54
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: _free$ErrorFileLast
                            • String ID: 8Q
                            • API String ID: 1547350101-4022487301
                            • Opcode ID: 386dc0a5ed07b5ef666f67fedbbd23e947b12db421e392d7aac5dd33c6427bef
                            • Instruction ID: 4e3d578620d285c3b38dc26c25ae8526b24f8d151cbd6d13f82ab3e909e78cbe
                            • Opcode Fuzzy Hash: 386dc0a5ed07b5ef666f67fedbbd23e947b12db421e392d7aac5dd33c6427bef
                            • Instruction Fuzzy Hash: 7D41E832B00605AFDB019BFACC81BDE3B75AF45328F240151E424E7B90FB30D8869726
                            Function 6CCFE418 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CCFE41D
                              • Part of subcall function 6CCFEE40: __EH_prolog.LIBCMT ref: 6CCFEE45
                              • Part of subcall function 6CCFE8EB: __EH_prolog.LIBCMT ref: 6CCFE8F0
                              • Part of subcall function 6CCFE593: __EH_prolog.LIBCMT ref: 6CCFE598
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: &qB$0aJ$A0$XqB
                            • API String ID: 3519838083-1326096578
                            • Opcode ID: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                            • Instruction ID: ec6684cc1989c66ea0374fdf90f52edce00b14353ba33af1021dcde070b31e8f
                            • Opcode Fuzzy Hash: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                            • Instruction Fuzzy Hash: 64218871D01248AACB09DBE5D9949EDBBB5AF25318F20406EE41667780EF785E0CCB61
                            Function 6CCAF12A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CCAF1B4,00000000,?,6CCAF235,6CCA9C49,00000003,00000000), ref: 6CCAF13F
                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CCAF152
                            • FreeLibrary.KERNEL32(00000000,?,?,6CCAF1B4,00000000,?,6CCAF235,6CCA9C49,00000003,00000000), ref: 6CCAF175
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: AddressFreeHandleLibraryModuleProc
                            • String ID: CorExitProcess$mscoree.dll
                            • API String ID: 4061214504-1276376045
                            • Opcode ID: 048448a2c61a976d005141f5deab8dc40ee26da71325a2ea0d6d1a2c1e6a89d1
                            • Instruction ID: b909018f621c53bff669bf636661dbc514a95e2af90a89d36066a159f6e80e96
                            • Opcode Fuzzy Hash: 048448a2c61a976d005141f5deab8dc40ee26da71325a2ea0d6d1a2c1e6a89d1
                            • Instruction Fuzzy Hash: D4F08C31A01219FBDF02DB91DC0DB9EBA78EF4535AF210060EA02E2050EB709E01DB90
                            Function 6CCA7327 Relevance: 7.5, APIs: 5, Instructions: 44COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog3.LIBCMT ref: 6CCA732E
                            • std::_Lockit::_Lockit.LIBCPMT ref: 6CCA7339
                            • std::_Lockit::~_Lockit.LIBCPMT ref: 6CCA73A7
                              • Part of subcall function 6CCA7230: std::locale::_Locimp::_Locimp.LIBCPMT ref: 6CCA7248
                            • std::locale::_Setgloballocale.LIBCPMT ref: 6CCA7354
                            • _Yarn.LIBCPMT ref: 6CCA736A
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
                            • String ID:
                            • API String ID: 1088826258-0
                            • Opcode ID: 6d224ced29ffefa32acad4ceb8a087f9a834008a112a6732fcdfee5f37db5a57
                            • Instruction ID: da2ea10391c7b180d7d4bf1d3867e1811e85b7aefad27dd7f1e91c4735e48d1b
                            • Opcode Fuzzy Hash: 6d224ced29ffefa32acad4ceb8a087f9a834008a112a6732fcdfee5f37db5a57
                            • Instruction Fuzzy Hash: A201BC75B005529BEB05EFA0C948ABD37B5FF86344B160009DA0297780EF34AA47DBD1
                            Function 6CD26E3F Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 452COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: $!$@
                            • API String ID: 3519838083-2517134481
                            • Opcode ID: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                            • Instruction ID: 1032187bf5b4cacad754ad9c382ed7b0ef6e7ef74a3b4304b0945373627d605f
                            • Opcode Fuzzy Hash: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                            • Instruction Fuzzy Hash: 0012A170D05249EFCF14CFA4C5909DEBBB1BF0930CF14846AE545ABB61DB38A946CB60
                            Function 6CCF2B91 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 284COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog__aulldiv
                            • String ID: $SJ
                            • API String ID: 4125985754-3948962906
                            • Opcode ID: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                            • Instruction ID: ae5a8f51b05ddedddee6abb5739f211ce036608327496f50917e60b94221937f
                            • Opcode Fuzzy Hash: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                            • Instruction Fuzzy Hash: 9EB13E71D002499FDB64CF95C8A49EEBBB1FF48314F60856ED426A7B50E730AA46CB60
                            Function 6CB72020 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 6CCA7327: __EH_prolog3.LIBCMT ref: 6CCA732E
                              • Part of subcall function 6CCA7327: std::_Lockit::_Lockit.LIBCPMT ref: 6CCA7339
                              • Part of subcall function 6CCA7327: std::locale::_Setgloballocale.LIBCPMT ref: 6CCA7354
                              • Part of subcall function 6CCA7327: _Yarn.LIBCPMT ref: 6CCA736A
                              • Part of subcall function 6CCA7327: std::_Lockit::~_Lockit.LIBCPMT ref: 6CCA73A7
                              • Part of subcall function 6CB72F60: std::_Lockit::_Lockit.LIBCPMT ref: 6CB72F95
                              • Part of subcall function 6CB72F60: std::_Lockit::_Lockit.LIBCPMT ref: 6CB72FAF
                              • Part of subcall function 6CB72F60: std::_Lockit::~_Lockit.LIBCPMT ref: 6CB72FD0
                              • Part of subcall function 6CB72F60: __Getctype.LIBCPMT ref: 6CB73084
                              • Part of subcall function 6CB72F60: std::_Facet_Register.LIBCPMT ref: 6CB7309C
                              • Part of subcall function 6CB72F60: std::_Lockit::~_Lockit.LIBCPMT ref: 6CB730B7
                            • std::ios_base::_Addstd.LIBCPMT ref: 6CB7211B
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$AddstdFacet_GetctypeH_prolog3RegisterSetgloballocaleYarnstd::ios_base::_std::locale::_
                            • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                            • API String ID: 3332196525-1866435925
                            • Opcode ID: 7494e3c3b6ddf6a418b19c640309c6154ce28d384d2d3f2e4f029b82c5ad8b71
                            • Instruction ID: 22a172bfe880a57c9f3c952e9f28d69807f9321fe03675c2672ac0ceef6139df
                            • Opcode Fuzzy Hash: 7494e3c3b6ddf6a418b19c640309c6154ce28d384d2d3f2e4f029b82c5ad8b71
                            • Instruction Fuzzy Hash: ED4191B0A00349DFDB10CF64C8497AEBBB1FF48318F144268E925AB791E775A985CF91
                            Function 6CD04EC7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CD04ECC
                              • Part of subcall function 6CCEF58A: __EH_prolog.LIBCMT ref: 6CCEF58F
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: :hJ$dJ$xJ
                            • API String ID: 3519838083-2437443688
                            • Opcode ID: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                            • Instruction ID: 643e191f4d4cb749b4ceb0d5d7468ac0edb8a39df16268cbeaec2576a0309438
                            • Opcode Fuzzy Hash: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                            • Instruction Fuzzy Hash: AE21A9B0801B40DFC760CF6AC14429ABBF4BF69718B50895EC1EA97B11E7B9B508CF59
                            Function 6CCBAD90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • SetFilePointerEx.KERNEL32(00000000,?,00000000,6CCBB0D0,6CB71DEA,00008000,6CCBB0D0,?,?,?,6CCBAC7F,6CCBB0D0,?,00000000,6CB71DEA), ref: 6CCBADC9
                            • GetLastError.KERNEL32(?,?,?,6CCBAC7F,6CCBB0D0,?,00000000,6CB71DEA,?,6CCC469E,6CCBB0D0,000000FF,000000FF,00000002,00008000,6CCBB0D0), ref: 6CCBADD3
                            • __dosmaperr.LIBCMT ref: 6CCBADDA
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ErrorFileLastPointer__dosmaperr
                            • String ID: 8Q
                            • API String ID: 2336955059-4022487301
                            • Opcode ID: 8bd51b8d5887e2605a732b85daf0035124fd76291e71af52a5b07ba373af0a7a
                            • Instruction ID: 8dd0f6026258e59de11619a6e6dedcb7aa8c0e5c90eebf1c9ccf78cf2591a1ec
                            • Opcode Fuzzy Hash: 8bd51b8d5887e2605a732b85daf0035124fd76291e71af52a5b07ba373af0a7a
                            • Instruction Fuzzy Hash: 15018433714515AFCF059FFADC0599E3B39EBC6325B240249E951AB680FB71E9418BA0
                            Function 6CCB49B2 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(00000008,?,00000000,6CCB8453), ref: 6CCB49B7
                            • _free.LIBCMT ref: 6CCB4A14
                            • _free.LIBCMT ref: 6CCB4A4A
                            • SetLastError.KERNEL32(00000000,00000008,000000FF), ref: 6CCB4A55
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ErrorLast_free
                            • String ID:
                            • API String ID: 2283115069-0
                            • Opcode ID: 73502db48b67624bedac127059dc1e14a169ee4372740e9590ea0784727217bd
                            • Instruction ID: 4b3612330fd8f1f55fbd145e283d9b1a5e221eddc9f0760232779d8836040e04
                            • Opcode Fuzzy Hash: 73502db48b67624bedac127059dc1e14a169ee4372740e9590ea0784727217bd
                            • Instruction Fuzzy Hash: 9B11CA327085006BAA01DAF9DC84D5E357EABC277C7250625F634B3BD0FF318C099224
                            Function 6CCC5EBA Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • WriteConsoleW.KERNEL32(00000000,?,6CCC46EC,00000000,00000000,?,6CCC4B51,00000000,00000001,00000000,6CCBB0D0,?,6CCBC286,?,?,6CCBB0D0), ref: 6CCC5ED1
                            • GetLastError.KERNEL32(?,6CCC4B51,00000000,00000001,00000000,6CCBB0D0,?,6CCBC286,?,?,6CCBB0D0,?,6CCBB0D0,?,6CCBBD1C,6CCC5AB6), ref: 6CCC5EDD
                              • Part of subcall function 6CCC5F2E: CloseHandle.KERNEL32(FFFFFFFE,6CCC5EED,?,6CCC4B51,00000000,00000001,00000000,6CCBB0D0,?,6CCBC286,?,?,6CCBB0D0,?,6CCBB0D0), ref: 6CCC5F3E
                            • ___initconout.LIBCMT ref: 6CCC5EED
                              • Part of subcall function 6CCC5F0F: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CCC5EAB,6CCC4B3E,6CCBB0D0,?,6CCBC286,?,?,6CCBB0D0,?), ref: 6CCC5F22
                            • WriteConsoleW.KERNEL32(00000000,?,6CCC46EC,00000000,?,6CCC4B51,00000000,00000001,00000000,6CCBB0D0,?,6CCBC286,?,?,6CCBB0D0,?), ref: 6CCC5F02
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                            • String ID:
                            • API String ID: 2744216297-0
                            • Opcode ID: bc9b3e57c527e6c8a368c71f0afc2a09426eceb993c45af06d7cc562ee9d64b6
                            • Instruction ID: 3158e285089b6153ef946aeef55498d4ec7f13a5b50cc0f082c41f3c705c4511
                            • Opcode Fuzzy Hash: bc9b3e57c527e6c8a368c71f0afc2a09426eceb993c45af06d7cc562ee9d64b6
                            • Instruction Fuzzy Hash: 35F03036600215BBCF125FE1DC0498D3F36FB4A7A1B084110FB1986220DB32D921EB91
                            Function 6CCB3124 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog3_
                            • String ID: 8Q
                            • API String ID: 2427045233-4022487301
                            • Opcode ID: bca0ba9efe28cc367593da6f5a218caa5b9ef4267ce370de57837b6c23711bfd
                            • Instruction ID: 4c80e4fef2ae6cf92088f00059c941518d3f2b723778469193f3765ae7ccd283
                            • Opcode Fuzzy Hash: bca0ba9efe28cc367593da6f5a218caa5b9ef4267ce370de57837b6c23711bfd
                            • Instruction Fuzzy Hash: AE71B374D052169FDB108BDAC884AEF7AB9BF45318F1C4229E920B7A40FF758847CB61
                            Function 6CCF8C58 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CCF8C5D
                              • Part of subcall function 6CCF761A: __EH_prolog.LIBCMT ref: 6CCF761F
                              • Part of subcall function 6CCF7A2E: __EH_prolog.LIBCMT ref: 6CCF7A33
                              • Part of subcall function 6CCF8EA5: __EH_prolog.LIBCMT ref: 6CCF8EAA
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: WZJ
                            • API String ID: 3519838083-1089469559
                            • Opcode ID: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                            • Instruction ID: 62c4b8319ade38918d5cdb65937a74f7af36716163204cb8531cace7eff98ed8
                            • Opcode Fuzzy Hash: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                            • Instruction Fuzzy Hash: 80817B35D00159DFCF15DFA9D890EDDB7B4AF19318F10409AE516A77A0EB30AE0ACB61
                            Function 6CB728E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON
                            Download Yara Rule
                            APIs
                            • ___std_exception_destroy.LIBVCRUNTIME ref: 6CB72A76
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ___std_exception_destroy
                            • String ID: Jbx$Jbx
                            • API String ID: 4194217158-1161259238
                            • Opcode ID: f508f055385af4b0210327f6869287e3806747585a7a7144180b7b94c6adbd57
                            • Instruction ID: 8ec1b8b3473a0f50aeaba5cb8752b39269c0fc9320158763932b28c5aba04f4b
                            • Opcode Fuzzy Hash: f508f055385af4b0210327f6869287e3806747585a7a7144180b7b94c6adbd57
                            • Instruction Fuzzy Hash: 4C5105B1D00244DFCB24CF68D884A9EBBB5EF89314F14856DEC599B741E331DA85CBA2
                            Function 6CD265B2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: CK$CK
                            • API String ID: 3519838083-2096518401
                            • Opcode ID: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                            • Instruction ID: 51fb842545255ec0dbffd03085ce36ececb5958784dd1f1362536899dc1c9308
                            • Opcode Fuzzy Hash: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                            • Instruction Fuzzy Hash: C151AD75A00305DFDB10DFA4C8C0BEEB3B5FB88319F148569DA01EBA51DB78A9068B70
                            Function 6CCBCEFE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,00000000,6CCC46D6), ref: 6CCBD01B
                            • __dosmaperr.LIBCMT ref: 6CCBD022
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: ErrorLast__dosmaperr
                            • String ID: 8Q
                            • API String ID: 1659562826-4022487301
                            • Opcode ID: 9ae0689b13d68ca94de2d2f74838fe47dbc5c00be4383b336fcc2dec854ff0d4
                            • Instruction ID: 569f4594ae260d3063c2ebdff27a453c9ad13001c5dd967e6b41a69855da0276
                            • Opcode Fuzzy Hash: 9ae0689b13d68ca94de2d2f74838fe47dbc5c00be4383b336fcc2dec854ff0d4
                            • Instruction Fuzzy Hash: 18419771614195AFDB11AFEDC880BAD7FA5EF86308F144299E880AB645F3719C16C790
                            Function 6CD14C24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: 0|J$`)L
                            • API String ID: 3519838083-117937767
                            • Opcode ID: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                            • Instruction ID: 9f6f4eaa1487fedfa9f04c9b5b4c86b2161fd6cc3a2ce0c8df5ce54e14ec7e50
                            • Opcode Fuzzy Hash: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                            • Instruction Fuzzy Hash: 7A41C071609741EFCF118FA0D4A07EEBBE2FF45208F01442EE15A97B60DB31A904CB92
                            Function 6CD10906 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: @$LuJ
                            • API String ID: 3519838083-205571748
                            • Opcode ID: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                            • Instruction ID: d6543e1c19468b36f013395ec8d1b50e6f2de5a79b0c057f4ec563cb4f7d2847
                            • Opcode Fuzzy Hash: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                            • Instruction Fuzzy Hash: 8D01C4B1E05389DADB10EF9984905AEF7B4FF59344F40842EE069E3A50D3346904CB55
                            Function 6CCBDD28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44memoryCOMMON
                            Download Yara Rule
                            APIs
                            • _free.LIBCMT ref: 6CCBDD49
                            • HeapReAlloc.KERNEL32(00000000,?,?,00000004,00000000,?,6CCBA63A,?,00000004,?,4B42FCB6,?,?,6CCAF78C,4B42FCB6,?), ref: 6CCBDD85
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2296660165.000000006CB21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB20000, based on PE: true
                            • Associated: 00000007.00000002.2296639556.000000006CB20000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297878676.000000006CCC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2300050576.000000006CE93000.00000002.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: AllocHeap_free
                            • String ID: 8Q
                            • API String ID: 1080816511-4022487301
                            • Opcode ID: fe4ddf092c19385dbde4cf00cfe161a222af37cb2e5b9844222eecf4a2000fc4
                            • Instruction ID: 9413c27309e81a997943572ebe4dd77237a77fd0903602b46f31832e3e8f83f8
                            • Opcode Fuzzy Hash: fe4ddf092c19385dbde4cf00cfe161a222af37cb2e5b9844222eecf4a2000fc4
                            • Instruction Fuzzy Hash: 1CF0C2326152066ADB211AF7AC44B9A37689FC3B78B110295F994BBE94FB30D801C6F4
                            Function 6CD3C5D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: p/K$J
                            • API String ID: 3519838083-2069324279
                            • Opcode ID: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                            • Instruction ID: a9e0e7a8aae79c7352b2c3a4b10fdc5895e68bee528f105c92f33916934ebdcb
                            • Opcode Fuzzy Hash: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                            • Instruction Fuzzy Hash: 8701BCB1A117219FD724CF58C5043AAF7F4EF45729F10C91E9096A3BA0D7F8A5088BA4
                            Function 6CD1AFC7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                            Download Yara Rule
                            APIs
                            • __EH_prolog.LIBCMT ref: 6CD1AFCC
                              • Part of subcall function 6CD1A4D1: __EH_prolog.LIBCMT ref: 6CD1A4D6
                              • Part of subcall function 6CD1914B: __EH_prolog.LIBCMT ref: 6CD19150
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID: H_prolog
                            • String ID: J$0J
                            • API String ID: 3519838083-2882003284
                            • Opcode ID: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                            • Instruction ID: b07cce7100f31be7722cc093689a971f5ee19bdb31ce5824c913c39c9297d338
                            • Opcode Fuzzy Hash: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                            • Instruction Fuzzy Hash: 2F01C5B1804B51CFC325CF56D5A468AFBE0BB15704F90C95EC0AA57B61D7B8A508CB68
                            Function 6CD34E19 Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: D)K$H)K$P)K$T)K
                            • API String ID: 0-2262112463
                            • Opcode ID: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                            • Instruction ID: 9ac36b4b3d04df58617ecabe8d0fcd600434cc76f198c3dcdd118c2a8ff2bbc4
                            • Opcode Fuzzy Hash: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                            • Instruction Fuzzy Hash: 0A512274904219DFCF01DF90DC50ADEBBB1AF1631CF15401AE95A67BA0EF7AA948CB50
                            Function 6CD54F20 Relevance: 5.0, Strings: 4, Instructions: 27COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000007.00000002.2297969558.000000006CCD8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CCD8000, based on PE: true
                            • Associated: 00000007.00000002.2298829200.000000006CDA3000.00000004.00000001.01000000.00000009.sdmpDownload File
                            • Associated: 00000007.00000002.2299130962.000000006CDA9000.00000020.00000001.01000000.00000009.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_7_2_6cb20000_#U5b89#U88c5#U52a9#U624b1.jbxd
                            Similarity
                            • API ID:
                            • String ID: (?K$8?K$H?K$CK
                            • API String ID: 0-3450752836
                            • Opcode ID: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                            • Instruction ID: 2b90f9f99aa4f95b30ab50a947dbef981daa9973a0770eb77f89b41885c3b14b
                            • Opcode Fuzzy Hash: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                            • Instruction Fuzzy Hash: 89F030B05017009FC360CF46D54869BF7F4EB41709F50C91EE09A9BA40D3B8A5088FB9