Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
#U5b89#U88c5#U52a9#U624b2.0.6.exe

Overview

General Information

Sample name:#U5b89#U88c5#U52a9#U624b2.0.6.exe
renamed because original name is a hash value
Original sample name:2.0.6.exe
Analysis ID:1580397
MD5:c5c5262b26879c84d470ef4a5b73663d
SHA1:c907618ac1db8f8186469e0bcfff2debc0b49fdd
SHA256:b53886e5499226b7565d65fd25ecd448f82434cac355d799ea2e39e0d822b234
Tags:exeSilverFoxwinosuser-kafan_shengui
Infos:

Detection

Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to hide a thread from the debugger
Found driver which could be used to inject code into processes
Hides threads from debuggers
Loading BitLocker PowerShell Module
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: New Kernel Driver Via SC.EXE
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • #U5b89#U88c5#U52a9#U624b2.0.6.exe (PID: 7764 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" MD5: C5C5262B26879C84D470EF4A5B73663D)
    • #U5b89#U88c5#U52a9#U624b2.0.6.tmp (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" MD5: 65559DDD30465F50270FB7E9EE6E6C7C)
      • powershell.exe (PID: 7836 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 2080 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • #U5b89#U88c5#U52a9#U624b2.0.6.exe (PID: 7920 cmdline: "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENT MD5: C5C5262B26879C84D470EF4A5B73663D)
        • #U5b89#U88c5#U52a9#U624b2.0.6.tmp (PID: 7996 cmdline: "C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$30452,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENT MD5: 65559DDD30465F50270FB7E9EE6E6C7C)
          • 7zr.exe (PID: 8108 cmdline: 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • 7zr.exe (PID: 7220 cmdline: 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs MD5: 84DC4B92D860E8AEA55D12B1E87EA108)
            • conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8076 cmdline: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8092 cmdline: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7432 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7452 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7552 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 692 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2832 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1004 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4744 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3112 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2444 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1256 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7728 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5492 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 872 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1912 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5652 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2376 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1592 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1792 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2016 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1992 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2240 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3236 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 316 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2836 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7892 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 3240 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3668 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5508 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4144 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4380 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8128 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 4120 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8096 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8184 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8172 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 8168 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4932 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7388 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7288 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7428 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 5972 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7452 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1900 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1380 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1004 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5112 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 3628 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 596 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7860 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7916 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 8040 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7728 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7564 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1256 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 7856 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 7852 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2988 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 5364 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1616 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 2992 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 1760 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • sc.exe (PID: 1820 cmdline: sc start CleverSoar MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 4712 cmdline: cmd /c start sc start CleverSoar MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp, ParentProcessId: 7820, ParentProcessName: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7836, ProcessName: powershell.exe
Sigma detected: New Kernel Driver Via SC.EXE
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8076, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 8092, ProcessName: sc.exe
Sigma detected: Powershell Defender Exclusion
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp, ParentProcessId: 7820, ParentProcessName: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7836, ProcessName: powershell.exe
Sigma detected: New Service Creation Using Sc.EXE
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8076, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto, ProcessId: 8092, ProcessName: sc.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp, ParentProcessId: 7820, ParentProcessName: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7836, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Windows NT\hrsw.vbcReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\update.vacReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\update.vacReversingLabs: Detection: 23%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 93.4% probability
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000C.00000003.1435045082.0000000001380000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000C.00000003.1434646463.0000000003D50000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.12.dr
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDCB430 FindFirstFileA,FindClose,FindClose,6_2_6CDCB430
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00756868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00756868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00757496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,10_2_00757496
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://ocsp.digicert.com0A
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://ocsp.digicert.com0C
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://ocsp.digicert.com0H
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://ocsp.digicert.com0I
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://ocsp.digicert.com0X
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://www.digicert.com/CPS0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000002.1552267523.00000000041E5000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe.6.dr, hrsw.vbc.6.dr, update.vac.2.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1375401020.000000007ED5B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1374701249.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000002.00000000.1376888852.0000000000A01000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000000.1397917138.0000000000E5D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.dr, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drString found in binary or memory: https://www.innosetup.com/
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1375401020.000000007ED5B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1374701249.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000002.00000000.1376888852.0000000000A01000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000000.1397917138.0000000000E5D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.dr, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drString found in binary or memory: https://www.remobjects.com/ps

Operating System Destruction

barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: 01 00 00 00 Jump to behavior

System Summary

barindex
PE file contains section with special chars
Source: update.vac.2.drStatic PE information: section name: .#.q
Source: hrsw.vbc.6.drStatic PE information: section name: .#.q
Source: update.vac.6.drStatic PE information: section name: .#.q
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD5690 NtSetInformationThread,OpenSCManagerA,CloseServiceHandle,OpenServiceA,CloseServiceHandle,6_2_6CDD5690
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC53886 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6CC53886
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC53C62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6CC53C62
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC53D62 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6CC53D62
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC53D18 NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6CC53D18
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC539CF NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6CC539CF
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD62D0 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,6_2_6CDD62D0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC53A6A NtSetInformationThread,GetCurrentThread,NtSetInformationThread,6_2_6CC53A6A
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC51950: CreateFileA,DeviceIoControl,CloseHandle,6_2_6CC51950
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC54754 _strlen,CreateFileA,CreateFileA,CloseHandle,_strlen,std::ios_base::_Ios_base_dtor,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,_strlen,TerminateProcess,GetCurrentProcess,TerminateProcess,_strlen,Sleep,ExitWindowsEx,Sleep,DeleteFileA,Sleep,_strlen,DeleteFileA,Sleep,_strlen,std::ios_base::_Ios_base_dtor,6_2_6CC54754
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC547546_2_6CC54754
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC64A276_2_6CC64A27
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD1DF06_2_6CDD1DF0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD6FB36_2_6CDD6FB3
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE36CE06_2_6CE36CE0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE86D106_2_6CE86D10
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE5AEEF6_2_6CE5AEEF
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE8EEF06_2_6CE8EEF0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE22EC96_2_6CE22EC9
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE08EA16_2_6CE08EA1
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE9C8D06_2_6CE9C8D0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE548966_2_6CE54896
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE968206_2_6CE96820
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE7E8106_2_6CE7E810
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE089726_2_6CE08972
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE989506_2_6CE98950
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE9A9306_2_6CE9A930
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE869006_2_6CE86900
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE94AA06_2_6CE94AA0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE60A526_2_6CE60A52
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE9EBC06_2_6CE9EBC0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE10BCA6_2_6CE10BCA
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE7AB906_2_6CE7AB90
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE20B666_2_6CE20B66
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE8E4D06_2_6CE8E4D0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE684AC6_2_6CE684AC
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE845D06_2_6CE845D0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE825806_2_6CE82580
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE8C5806_2_6CE8C580
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE725216_2_6CE72521
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE985206_2_6CE98520
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE9E6006_2_6CE9E600
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE6C7F36_2_6CE6C7F3
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE0C7CF6_2_6CE0C7CF
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE967A06_2_6CE967A0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE8E0E06_2_6CE8E0E0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE800206_2_6CE80020
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE9C2A06_2_6CE9C2A0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE982006_2_6CE98200
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE57D436_2_6CE57D43
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE83D506_2_6CE83D50
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE89E806_2_6CE89E80
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE61F116_2_6CE61F11
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE7589F6_2_6CE7589F
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE899F06_2_6CE899F0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE7DAD06_2_6CE7DAD0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE81AA06_2_6CE81AA0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE7FA506_2_6CE7FA50
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE2540A6_2_6CE2540A
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE4F5EC6_2_6CE4F5EC
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE8F5C06_2_6CE8F5C0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE896E06_2_6CE896E0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE9F6406_2_6CE9F640
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE7B6506_2_6CE7B650
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CEA37C06_2_6CEA37C0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE96AF06_2_6CE96AF0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE937506_2_6CE93750
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007981EC10_2_007981EC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D81C010_2_007D81C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007C425010_2_007C4250
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E824010_2_007E8240
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007EC3C010_2_007EC3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E04C810_2_007E04C8
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007C865010_2_007C8650
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007CC95010_2_007CC950
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007A094310_2_007A0943
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007C8C2010_2_007C8C20
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E0E0010_2_007E0E00
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E4EA010_2_007E4EA0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007B10AC10_2_007B10AC
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007DD08910_2_007DD089
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E112010_2_007E1120
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007CD1D010_2_007CD1D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E91C010_2_007E91C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D518010_2_007D5180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007ED2C010_2_007ED2C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007B53F310_2_007B53F3
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007553CF10_2_007553CF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007ED47010_2_007ED470
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E54D010_2_007E54D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0079D49610_2_0079D496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0075157210_2_00751572
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E155010_2_007E1550
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007A965210_2_007A9652
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007DD6A010_2_007DD6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0076976610_2_00769766
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007597CA10_2_007597CA
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007ED9E010_2_007ED9E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00751AA110_2_00751AA1
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D5E8010_2_007D5E80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D5F8010_2_007D5F80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0076E00A10_2_0076E00A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D22E010_2_007D22E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007F230010_2_007F2300
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007BE49F10_2_007BE49F
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D25F010_2_007D25F0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007C66D010_2_007C66D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007CA6A010_2_007CA6A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007EE99010_2_007EE990
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D2A8010_2_007D2A80
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007AAB1110_2_007AAB11
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D6CE010_2_007D6CE0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D70D010_2_007D70D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007BB12110_2_007BB121
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007CB18010_2_007CB180
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E720010_2_007E7200
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0077B3E410_2_0077B3E4
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007EF3C010_2_007EF3C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007DF3A010_2_007DF3A0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007DF42010_2_007DF420
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007C741010_2_007C7410
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E353010_2_007E3530
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007F351A10_2_007F351A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007CF50010_2_007CF500
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007EF59910_2_007EF599
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007F360110_2_007F3601
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007E77C010_2_007E77C0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007C379010_2_007C3790
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0077F8E010_2_0077F8E0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007CF91010_2_007CF910
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D7AF010_2_007D7AF0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007A3AEF10_2_007A3AEF
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0076BAC910_2_0076BAC9
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D7C5010_2_007D7C50
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0076BC9210_2_0076BC92
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: String function: 6CE09240 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: String function: 6CEA6F10 appears 633 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 007EFB10 appears 723 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 007528E3 appears 34 times
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: String function: 00751E40 appears 125 times
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.drStatic PE information: Number of sections : 11 > 10
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000000.1373065115.0000000000239000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileNameHqNrI09VdzkFeYys.exe vs #U5b89#U88c5#U52a9#U624b2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1375401020.000000007F05A000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameHqNrI09VdzkFeYys.exe vs #U5b89#U88c5#U52a9#U624b2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1374701249.00000000038EE000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameHqNrI09VdzkFeYys.exe vs #U5b89#U88c5#U52a9#U624b2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeBinary or memory string: OriginalFileNameHqNrI09VdzkFeYys.exe vs #U5b89#U88c5#U52a9#U624b2.0.6.exe
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: tProtect.dll.12.drBinary string: \Device\TfSysMon
Source: tProtect.dll.12.drBinary string: \Device\TfKbMonPWLCache
Source: classification engineClassification label: mal88.evad.winEXE@144/33@0/0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD62D0 OpenProcessToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,NtInitiatePowerAction,6_2_6CDD62D0
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00759313 _isatty,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,10_2_00759313
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00763D66 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,10_2_00763D66
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00759252 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,10_2_00759252
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD57B0 CreateToolhelp32Snapshot,CloseHandle,Process32NextW,Process32FirstW,6_2_6CDD57B0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\is-PQ622.tmpJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3004:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7508:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3316:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7536:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3276:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4292:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1868:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3732:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3556:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5608:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1420:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1948:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4324:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3352:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2508:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6592:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3112:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4220:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1820:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8180:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeFile created: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmpJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeFile read: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe"
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENT
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$30452,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENT
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
Source: C:\Program Files (x86)\Windows NT\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c start sc start CleverSoar
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeProcess created: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp "C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$30452,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9ialdJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Program Files (x86)\Windows NT\7zr.exe 7zr.exe x -y locale3.dat -pasfasdf79yf9layslofsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpWindow found: window name: TMainFormJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic file information: File size 8206704 > 1048576
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\builddir\threat~1.26\drivers\tfsysmon\objfre_wnet_amd64\amd64\TfSysMon.pdb source: 7zr.exe, 0000000C.00000003.1435045082.0000000001380000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 0000000C.00000003.1434646463.0000000003D50000.00000004.00001000.00020000.00000000.sdmp, tProtect.dll.12.dr
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D57D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,10_2_007D57D0
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drStatic PE information: real checksum: 0x0 should be: 0x3438fd
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: real checksum: 0x0 should be: 0x7dfa3a
Source: update.vac.6.drStatic PE information: real checksum: 0x0 should be: 0x378c79
Source: update.vac.2.drStatic PE information: real checksum: 0x0 should be: 0x378c79
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.drStatic PE information: real checksum: 0x0 should be: 0x3438fd
Source: hrsw.vbc.6.drStatic PE information: real checksum: 0x0 should be: 0x378c79
Source: tProtect.dll.12.drStatic PE information: real checksum: 0x1eb0f should be: 0xfc66
Source: #U5b89#U88c5#U52a9#U624b2.0.6.exeStatic PE information: section name: .didata
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.drStatic PE information: section name: .didata
Source: update.vac.2.drStatic PE information: section name: .00cfg
Source: update.vac.2.drStatic PE information: section name: .voltbl
Source: update.vac.2.drStatic PE information: section name: .#.q
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drStatic PE information: section name: .didata
Source: 7zr.exe.6.drStatic PE information: section name: .sxdata
Source: hrsw.vbc.6.drStatic PE information: section name: .00cfg
Source: hrsw.vbc.6.drStatic PE information: section name: .voltbl
Source: hrsw.vbc.6.drStatic PE information: section name: .#.q
Source: update.vac.6.drStatic PE information: section name: .00cfg
Source: update.vac.6.drStatic PE information: section name: .voltbl
Source: update.vac.6.drStatic PE information: section name: .#.q
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD8C5B push ecx; ret 6_2_6CDD8C6E
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC80F00 push ss; retn 0001h6_2_6CC80F0A
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CEA6F10 push eax; ret 6_2_6CEA6F2E
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CE0B9F4 push 004AC35Ch; ret 6_2_6CE0BA0E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007545F4 push 007FC35Ch; ret 10_2_0075460E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007EFB10 push eax; ret 10_2_007EFB2E
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007EFE90 push eax; ret 10_2_007EFEBE
Source: update.vac.2.drStatic PE information: section name: .#.q entropy: 7.193027440134885
Source: hrsw.vbc.6.drStatic PE information: section name: .#.q entropy: 7.193027440134885
Source: update.vac.6.drStatic PE information: section name: .#.q entropy: 7.193027440134885
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\update.vacJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeFile created: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeFile created: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeFile created: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\7zr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpFile created: C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\update.vacJump to dropped file
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6235Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3448Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpWindow / User API: threadDelayed 621Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpWindow / User API: threadDelayed 621Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpWindow / User API: threadDelayed 576Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\update.vacJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\hrsw.vbcJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\tProtect.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\update.vacJump to dropped file
Source: C:\Program Files (x86)\Windows NT\7zr.exeAPI coverage: 7.6 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004Thread sleep count: 6235 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004Thread sleep count: 3448 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060Thread sleep time: -9223372036854770s >= -30000sJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDCB430 FindFirstFileA,FindClose,FindClose,6_2_6CDCB430
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00756868 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00756868
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00757496 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,10_2_00757496
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_00759C60 GetSystemInfo,10_2_00759C60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000002.00000002.1404286591.000000000078D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CC53886 NtSetInformationThread 00000000,00000011,00000000,000000006_2_6CC53886
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDE06F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_6CDE06F1
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007D57D0 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,10_2_007D57D0
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDDF6ED mov eax, dword ptr fs:[00000030h]6_2_6CDDF6ED
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDEA2D6 mov eax, dword ptr fs:[00000030h]6_2_6CDEA2D6
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDEA2A5 mov eax, dword ptr fs:[00000030h]6_2_6CDEA2A5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDE06F1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_6CDE06F1
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpCode function: 6_2_6CDD922D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_6CDD922D

HIPS / PFW / Operating System Protection Evasion

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"Jump to behavior
Found driver which could be used to inject code into processes
Source: tProtect.dll.12.drStatic PE information: Found potential injection code
Source: C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe "C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENTJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmpProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= autoJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoarJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc start CleverSoar
Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007F0320 cpuid 10_2_007F0320
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_0075AB2A GetSystemTimeAsFileTime,10_2_0075AB2A
Source: C:\Program Files (x86)\Windows NT\7zr.exeCode function: 10_2_007F0090 GetVersion,10_2_007F0090

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
Windows Service		1
Access Token Manipulation		11
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Service Execution		1
DLL Side-Loading		1
Windows Service		1
Disable or Modify Tools		LSASS Memory421
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Native API		Logon Script (Windows)111
Process Injection		231
Virtualization/Sandbox Evasion		Security Account Manager231
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
Access Token Manipulation		NTDS2
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script111
Process Injection		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Deobfuscate/Decode Files or Information		Cached Domain Credentials2
System Owner/User Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
Obfuscated Files or Information		DCSync3
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Software Packing		Proc Filesystem25
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
DLL Side-Loading		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580397 Sample: #U5b89#U88c5#U52a9#U624b2.0.6.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 88 90 Multi AV Scanner detection for dropped file 2->90 92 Found driver which could be used to inject code into processes 2->92 94 PE file contains section with special chars 2->94 96 2 other signatures 2->96 10 #U5b89#U88c5#U52a9#U624b2.0.6.exe 2 2->10         started        13 cmd.exe 2->13         started        15 cmd.exe 2->15         started        17 31 other processes 2->17 process3 file4 86 C:\...\#U5b89#U88c5#U52a9#U624b2.0.6.tmp, PE32 10->86 dropped 19 #U5b89#U88c5#U52a9#U624b2.0.6.tmp 3 5 10->19         started        23 sc.exe 1 13->23         started        25 sc.exe 1 15->25         started        27 sc.exe 1 17->27         started        29 sc.exe 1 17->29         started        31 sc.exe 1 17->31         started        33 27 other processes 17->33 process5 file6 72 C:\Users\user\AppData\Local\...\update.vac, PE32 19->72 dropped 74 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 19->74 dropped 98 Adds a directory exclusion to Windows Defender 19->98 35 #U5b89#U88c5#U52a9#U624b2.0.6.exe 2 19->35         started        38 powershell.exe 23 19->38         started        41 conhost.exe 23->41         started        43 conhost.exe 25->43         started        45 conhost.exe 27->45         started        47 conhost.exe 29->47         started        49 conhost.exe 31->49         started        51 conhost.exe 33->51         started        53 26 other processes 33->53 signatures7 process8 file9 76 C:\...\#U5b89#U88c5#U52a9#U624b2.0.6.tmp, PE32 35->76 dropped 55 #U5b89#U88c5#U52a9#U624b2.0.6.tmp 4 16 35->55         started        100 Loading BitLocker PowerShell Module 38->100 59 conhost.exe 38->59         started        61 WmiPrvSE.exe 38->61         started        signatures10 process11 file12 78 C:\Users\user\AppData\Local\...\update.vac, PE32 55->78 dropped 80 C:\Program Files (x86)\Windows NT\hrsw.vbc, PE32 55->80 dropped 82 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 55->82 dropped 84 C:\Program Files (x86)\Windows NT\7zr.exe, PE32 55->84 dropped 102 Query firmware table information (likely to detect VMs) 55->102 104 Protects its processes via BreakOnTermination flag 55->104 106 Hides threads from debuggers 55->106 108 Contains functionality to hide a thread from the debugger 55->108 63 7zr.exe 2 55->63         started        66 7zr.exe 7 55->66         started        signatures13 process14 file15 88 C:\Program Files (x86)\...\tProtect.dll, PE32+ 63->88 dropped 68 conhost.exe 63->68         started        70 conhost.exe 66->70         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
#U5b89#U88c5#U52a9#U624b2.0.6.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\Windows NT\7zr.exe0%ReversingLabs
C:\Program Files (x86)\Windows NT\hrsw.vbc24%ReversingLabs
C:\Program Files (x86)\Windows NT\tProtect.dll9%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\update.vac24%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\update.vac24%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU#U5b89#U88c5#U52a9#U624b2.0.6.exefalse
    		high
    https://www.remobjects.com/ps#U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1375401020.000000007ED5B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1374701249.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000002.00000000.1376888852.0000000000A01000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000000.1397917138.0000000000E5D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.dr, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drfalse
      		high
      https://www.innosetup.com/#U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1375401020.000000007ED5B000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.exe, 00000000.00000003.1374701249.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000002.00000000.1376888852.0000000000A01000.00000020.00000001.01000000.00000004.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp, 00000006.00000000.1397917138.0000000000E5D000.00000020.00000001.01000000.00000008.sdmp, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.0.dr, #U5b89#U88c5#U52a9#U624b2.0.6.tmp.5.drfalse
        		high

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1580397
        Start date and time:2024-12-24 13:02:13 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 9m 56s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:110
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Critical Process Termination
        Sample name:#U5b89#U88c5#U52a9#U624b2.0.6.exe
        renamed because original name is a hash value
        Original Sample Name:2.0.6.exe
        Detection:MAL
        Classification:mal88.evad.winEXE@144/33@0/0
        EGA Information:
        • Successful, ratio: 100%
        HCA Information:
        • Successful, ratio: 77%
        • Number of executed functions: 28
        • Number of non-executed functions: 72
        Cookbook Comments:
        • Found application associated with file extension: .exe

        Warnings

        • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe
        • Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
        • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
        • Not all processes where analyzed, report is missing behavior information
        • Report size exceeded maximum capacity and may have missing behavior information.
        • Report size exceeded maximum capacity and may have missing disassembly code.
        • Report size getting too big, too many NtCreateKey calls found.
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        • VT rate limit hit for: #U5b89#U88c5#U52a9#U624b2.0.6.exe

        Simulations

        Behavior and APIs

        TimeTypeDescription
        07:03:12API Interceptor1x Sleep call for process: #U5b89#U88c5#U52a9#U624b2.0.6.tmp modified
        07:03:15API Interceptor26x Sleep call for process: powershell.exe modified

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        C:\Program Files (x86)\Windows NT\7zr.exe#U5b89#U88c5#U52a9#U624b2.0.4.exeGet hashmaliciousUnknownBrowse
          #U5b89#U88c5#U52a9#U624b2.0.5.exeGet hashmaliciousUnknownBrowse
            #U5b89#U88c5#U52a9#U624b2.0.2.exeGet hashmaliciousUnknownBrowse
              #U5b89#U88c5#U52a9#U624b2.0.3.exeGet hashmaliciousUnknownBrowse
                #U5b89#U88c5#U52a9#U624b2.0.1.exeGet hashmaliciousUnknownBrowse
                  cVyexkZjrG.exeGet hashmaliciousUnknownBrowse
                    cVyexkZjrG.exeGet hashmaliciousUnknownBrowse
                      #U5b89#U88c5#U52a9#U624b1.0.3.exeGet hashmaliciousUnknownBrowse
                        #U5b89#U88c5#U52a9#U624b1.0.1.exeGet hashmaliciousUnknownBrowse
                          #U5b89#U88c5#U52a9#U624b1.0.2.exeGet hashmaliciousUnknownBrowse

                            Created / dropped Files

                            C:\Program Files (x86)\Windows NT\7zr.exe

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:PE32 executable (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):831200
                            Entropy (8bit):6.671005303304742
                            Encrypted:false
                            SSDEEP:24576:A48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Ae71MzuiehWIKxZ
                            MD5:84DC4B92D860E8AEA55D12B1E87EA108
                            SHA1:56074A031A81A2394770D4DA98AC01D99EC77AAD
                            SHA-256:BA1EC2C30212F535231EBEB2D122BDA5DD0529D80769495CCFD74361803E3880
                            SHA-512:CF3552AD1F794582F406FB5A396477A2AA10FCF0210B2F06C3FC4E751DB02193FB9AA792CD994FA398462737E9F9FFA4F19F095A82FC48F860945E98F1B776B7
                            Malicious:false
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 0%
                            Joe Sandbox View:
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.4.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.5.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.2.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.3.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b2.0.1.exe, Detection: malicious, Browse
                            • Filename: cVyexkZjrG.exe, Detection: malicious, Browse
                            • Filename: cVyexkZjrG.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.3.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.1.exe, Detection: malicious, Browse
                            • Filename: #U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9A..} ..} ..} ...<... ...?..~ ...<..t ...?..v ...?... ...(.| ..} ... ...(.t ..K.... ..k_..~ ..K...~ ..f."._ ...R..x ...&..| ..Rich} ..........PE..L....\.d.....................N......:.............@..........................@............@.....................................x........................&.......d......................................................H............................text.............................. ..`.rdata..RZ.......\..................@..@.data...ds... ......................@....sxdata.............................@....rsrc...............................@..@.reloc..2r.......t..................@..B................................................................................................................................................................................................................................................

                            C:\Program Files (x86)\Windows NT\file.bin (copy)

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):2410545
                            Entropy (8bit):7.999922598249243
                            Encrypted:true
                            SSDEEP:49152:g6wAukW+yiCbwWUfNV0nkGyIjg1QzigxBeCOg227duaZIN4Zud:g6wlkW+yEWWKkTr7gxAHgtuGyqud
                            MD5:22AB3F365A4BE4A19F0905AB757C3702
                            SHA1:AA1FB50388CD3DBE4495A26601EFA09C7B8229EF
                            SHA-256:709B2D4134B4C54CB331B0C3FA5226CC49C55AD29BC2F5548745FB213F5C0DEB
                            SHA-512:460C32CE230CCA3ED396275725381DB98289B6ACD250CBD7037E2597C849924EA839C5F70B71A8FFF9A5E09C878C52FD6D29F0339F507D3F2C317660F72C5F18
                            Malicious:false
                            Preview:.@S....<.(.,;..............Q9:..9.....&./.}.....|..t%.p.S|O.C0c..i.a6..x.e...I,.r........E`....U...y.<0a.{S.....NL.U".h.gu..J8....@b...vtL.UR.......4...(..W.O.k6..s.2|...uo.&.....,.7.i.6l.b.:..'...%........x..H...zW.\N..)9y....V....-i.....j."v.[....z.oZ.!.......y..7j..'J...U.yI.,....<.9)Q.C.z...l.....CGe:.....?*%i.c$.....:).5.e!z*..qs"..^&,..*g...*.4......".P.r{.P...~...j....y...q..;.o`..[..Ef..E}e.L..1$.^x.j.5...,$v.N.1..o.....4&.bs.C.$.NN.d.+``>.4V....{0..([M....@.$.F..Cd.....C..@P.z.I+.S..-.tA?...od..B:+!.Y..>..H....cM.e/.....+.........C.v.....c....v..u..~...;.z...L..b'...f.1K<.F|.......A,H.z..lf.)0.....l_,...W.....2....b..L.....].c...f#I.F......213....KS.K.......b..DO....Jv|..zHh&!.qo.....[.z.1..z..A.a..=1l..}..o..9....F.2.w:F3.ca.7.d.4X)-.|.wB......"!.3m.rt....fGM...#W...m.".L.m..t.E.....i.X.k8z..4.8..F....-.y...3,k... &..O.....T...7...A..1.b..:g....L..I.`.d.n"...{..g........f....%..r....W]a.Q......K..,..Aa....N.....6vB...9B.

                            C:\Program Files (x86)\Windows NT\hrsw.vbc

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3606016
                            Entropy (8bit):7.0063494494702985
                            Encrypted:false
                            SSDEEP:49152:/MifTj964EMRY42Kgq7eJEJqx2dhZe71MzuiehWIKxZfAtbyBSfbZmSKiyQF:/M+jcZ42KXw2dhZe71MzSRFyBSDH
                            MD5:95ACD5631A9131DB1FD066565AFC9A67
                            SHA1:8E9473BD632FF0F57FC34EECAC17174341D80D94
                            SHA-256:EA6B71519CD54AB523B822F84D5D4E5B305214DA4C37E96A02D8BC1CB182F58B
                            SHA-512:70188E7AD6B0D9DA5E88EEFC6095F99066F73FDAB10F084E3F2F96B30D8A717BAE75E9C1B476FB996BC86B9A753AAF26F96024D0068090B437EACE6E5BE35681
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 24%
                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Fig...........!.....h....................................................7...........@.........................XC.......J..<....07.X....................@7..?...................................................K...............................text....f.......h.................. ..`.rdata..T............l..............@..@.data................b..............@....00cfg.......`(......"(.............@..@.tls.........p(......$(.............@....voltbl.F.....(......&(..................#.q....P.....(......((............. ..`.rsrc...X....07.......6.............@..@.reloc...?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                            C:\Program Files (x86)\Windows NT\is-PQ622.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):2410545
                            Entropy (8bit):7.999922598249243
                            Encrypted:true
                            SSDEEP:49152:g6wAukW+yiCbwWUfNV0nkGyIjg1QzigxBeCOg227duaZIN4Zud:g6wlkW+yEWWKkTr7gxAHgtuGyqud
                            MD5:22AB3F365A4BE4A19F0905AB757C3702
                            SHA1:AA1FB50388CD3DBE4495A26601EFA09C7B8229EF
                            SHA-256:709B2D4134B4C54CB331B0C3FA5226CC49C55AD29BC2F5548745FB213F5C0DEB
                            SHA-512:460C32CE230CCA3ED396275725381DB98289B6ACD250CBD7037E2597C849924EA839C5F70B71A8FFF9A5E09C878C52FD6D29F0339F507D3F2C317660F72C5F18
                            Malicious:false
                            Preview:.@S....<.(.,;..............Q9:..9.....&./.}.....|..t%.p.S|O.C0c..i.a6..x.e...I,.r........E`....U...y.<0a.{S.....NL.U".h.gu..J8....@b...vtL.UR.......4...(..W.O.k6..s.2|...uo.&.....,.7.i.6l.b.:..'...%........x..H...zW.\N..)9y....V....-i.....j."v.[....z.oZ.!.......y..7j..'J...U.yI.,....<.9)Q.C.z...l.....CGe:.....?*%i.c$.....:).5.e!z*..qs"..^&,..*g...*.4......".P.r{.P...~...j....y...q..;.o`..[..Ef..E}e.L..1$.^x.j.5...,$v.N.1..o.....4&.bs.C.$.NN.d.+``>.4V....{0..([M....@.$.F..Cd.....C..@P.z.I+.S..-.tA?...od..B:+!.Y..>..H....cM.e/.....+.........C.v.....c....v..u..~...;.z...L..b'...f.1K<.F|.......A,H.z..lf.)0.....l_,...W.....2....b..L.....].c...f#I.F......213....KS.K.......b..DO....Jv|..zHh&!.qo.....[.z.1..z..A.a..=1l..}..o..9....F.2.w:F3.ca.7.d.4X)-.|.wB......"!.3m.rt....fGM...#W...m.".L.m..t.E.....i.X.k8z..4.8..F....-.y...3,k... &..O.....T...7...A..1.b..:g....L..I.`.d.n"...{..g........f....%..r....W]a.Q......K..,..Aa....N.....6vB...9B.

                            C:\Program Files (x86)\Windows NT\is-V197H.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):2160403
                            Entropy (8bit):7.999915137888149
                            Encrypted:true
                            SSDEEP:49152:It2n0GjjLAmAsqpaBu1j6HHY98iLNC9s0GSUCrtIQ:fImVwassHHeLmGSPtIQ
                            MD5:0CEBF47D80812A6BAC25DBB7BBD2A4BA
                            SHA1:60C7165E374A09465A6864964E6FCE777A6A397E
                            SHA-256:A3783734750CAE6E97CF1A2FAA2E8716B6C91A9F1D05C23C1370969D01772353
                            SHA-512:D39E65CD10D767937907F1EDD1AA6F1F0D73D83F852635A10C4809C0161D0634C3E8764DD019CB19DEEC7D299D5268D27154997F05675B0E061D0D1C6AC8EB8D
                            Malicious:false
                            Preview:.U_O..h...=...`.f5...........3...._E..M...A.P..)....8.&>..9...Uye..,.X$.^.T...$...\2.uz>H.>E........B#..y..0...k`..C..!.."}.~)..X..gR.P.....E.@l...Tr...._m..m..Pv.....7?A.Z.o#..I>..)S.1.+...........j.L.b....B.2..T. `e_..d:m.~..B..hw..S............YS..:.v`}..%...1.c.H.W.....Y....\..q....$4..+jN.,q...ra.....v*".J$.9.. .}k<..cC...k%7.i+~`.....g.......m.`.3z.......tQxf...vJ:zpV..<..oi)...C....a.G.]...@E]../h..0.e.B..u......@\%.E...T..w....O...3$j.7TTK.?]a..1^/g...05;D. ...Y.&..!......f!.V.......).M..n..].[hu.).....Mc.$l}Db....\..W`...R..0.......)"....n.WR..Y.O...".r.._..>...b.z..d.......w8.,v...9.l.R.U\{..=.}.g.@........Ut.3..Y.....m.....yKz..S?.q..P.qs...il.mN<L..-]m...P..0.z\.`#]....hQL.<...\.Xa.;..V.!.....cJx.\..!t;5< E.&C.~ ;$.u..z..Ay8......#..=.+.....P..B/.'(J..L..hR.h..H.3."..&.!.{.q.*....(.06...............6...........G.Oe......e=.2:AK."o#}>||...!.C....n....M...7....u..=..!..~.. ......N..[Me;OFj.....^V..X5.9}#..Y&.*..".[.`...

                            C:\Program Files (x86)\Windows NT\locale.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):56530
                            Entropy (8bit):7.996728823788979
                            Encrypted:true
                            SSDEEP:1536:VrioFfO629rsDfMEfSVSK8eBlsiviev1MQdQe:V9FfO6fdmSiB1R
                            MD5:5A288ABE66B6DA4DB8C201C03A9ECC52
                            SHA1:EBBDD65A036F97D6F934243B5987D06CB7B7E367
                            SHA-256:C28544764B28D5ED1495194D2390427883D9A0E939B2B68D79C0FD4C68D78888
                            SHA-512:EC0AE2FC22D214AFE200943AE9849F355BFD35355099A0B02991B87236E9626858ED96E9D05468DA3613DDFC50B04F220CB2D9E59EC04F72938C5052E3E5E82F
                            Malicious:false
                            Preview:.@S....93).| ..............:I@.$c......].....<lxe...=.\Kx...X..c.HP..M.:.N.~..T#....6.#......$...w..p.n.~.8\Q.b.y.C.d..`.[../K...g..O.+..?..Qs.T..Z..E..g.6^|..S..]z.u.......0cb.'...+.I....8.q..[>..i..f.X|4=.Hk.q..H`MW.../..^H..>%...i.qk.i.K.[.9...$n...Q......+E..+.......rV0/E...1M>3[....."2m.g.7.).....L..'......gG..,....d..ujm........4.....GN....&.b.E.iw...`S...<..p.......D.....t..o.n.P...yt%..G..C..R..&.ps...."...~......m.%.\w.|.'4...).9.=rE.=...7.....)..t .S.M.=....m.Q.g.....z3.2.......*;./#..e.VaB...X.*...d..{7g.C8).y.,..c...m....r...-.>.3....0.OX...d..xR.6.h.....qH.y+. ..Bs\C..qJ...3q.~........2R.0._a.}.".....!d.....!.R.Ha...}....e.e.;Ts...F..nx.{..f.....7..v. ..X....T=.o.^].>.FU..O....j..c@Jo4!..]...%...R.`.....4."DY8....?.0!..>!..".3.b...".L.Q."..P.f.....wp.7.... .2..GY.?M....]...C.-.E...k.'f&?`........`Gm...d.[.n...v.....U.F.{(..g...R.].....o=.V...1S.k......W$..(x.'.j^..ju.=eD.N..j.~K..J...(..,....cr...G.Il{;.Yam.../j.d..

                            C:\Program Files (x86)\Windows NT\locale.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):56530
                            Entropy (8bit):7.99672882378898
                            Encrypted:true
                            SSDEEP:1536:LLTAuZTNshF+E4azBIlUpDAWPl3TjoVnVVDbsSpWR2q:Lf/u+Vaz2G5AWVTcVnVVnsSoRr
                            MD5:DA365B62C29AA40AB63B36267E132538
                            SHA1:F98E46F576EF5B2FDA1FBCF0FFB455BB91485F0E
                            SHA-256:2522BA39C177784BFEAD3D02AD9F1F778A3ECD389F1114FF41C0D2008D5A02EC
                            SHA-512:8A8037AB919D4B0FA80B9AE0DD82EA1CB443E134A2893AC380F395F9F9EAB722B92446B8F4EA869A4B2C832B6F987975B593E4B42386D7B3F87251B9B74E3717
                            Malicious:false
                            Preview:7z..'......'........2............%M].r..-.?lS.....C6>.!.....s..^.x..sJ.....+Y....5cBN.'.{+Z;..q..&wo....8.`....Z.4.N.u...j.9..5.j..b.F.T..=...t..A..adB.|3....i..j{....yt.&.C.Rw..o..O....RB:..I.gS..Mc.T..f.......N........8..cv.......@/9.....^.j....(.O.i.F.<.~.....w.Q.^.4JQ+I....|......R...9..|.Q.m...%.Q.....5..3.....A.b.!.d..kV...b...&..-.gI.W m....:..E. .-..=.s%s..<m..b0.Gce.....At...E.........C...rR./.P .j.....1.hn..)|..}3.d6....l..G.s...'>`.P.....f.3,2\..,..L......<...?..f^;@.U.....z.w.....j0<V..X...I..p=.......#.}.X;..5h{....../n...-..s=|...8.....M._...+l....G.....0x.,N...gV........G.H......w...'K^.....8.).XR......-.4.V..H..pX.h'.B.t..i6>.d0`.9.%.i..?.>.i....Q..m.)..k=......E3*..F.Z..1....dn..h.x.^......U..!.`...}....-..=.).......~..AC..4['M...q..E:...v.7.g=..N....Og..o..B.iK.L.H3..b./ N",...O.).n..o8.$...N#.x...|S...Q...x.}..v`w.....Y..q./.....u.;V...-.NjgSD...._'2....#>.^..Y...a.>...s..-...h.f~.#g..<..r...O..IHhS....V.g......\.....0...6.

                            C:\Program Files (x86)\Windows NT\locale2.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):56546
                            Entropy (8bit):7.996966859255975
                            Encrypted:true
                            SSDEEP:1536:crCPEbYP46GiC3q6cGOlLvjmS9UWgvy/F2QFtTVAe:iCIR913q8wjmS9bhKe
                            MD5:CEA69F993E1CE0FB945A98BF37A66546
                            SHA1:7114365265F041DA904574D1F5876544506F89BA
                            SHA-256:E834D26D571776C889E2D09892C6E562EA62CD6524D8FC625E6496A1742F5DBB
                            SHA-512:4BCBB5AD50446CD4FAD5ED3C530E29CC9DD7DDCB7B912D7C546AF8CCF7DA74BC1EEC397846BFB97858BABC9AA46BB3F3D0434F414BBC3B15B9FDBB7BF3ED59F9
                            Malicious:false
                            Preview:.@S....c...l ...............3...Q...R]..u&.(..c...o.A..q?oIS.j..O[..o..&....L)......Rm.jC,./....-=...Z.;..7..tH..f...n#.7.P#..#o..D..y....m........zH.!...M.|......Vs.^.Rb.X`....y.T.Sg....T.....E.?/.H.;h.)P.#.pz.LOG$..."L(.....?.D*.6g.J!.>.....f.....J..B..q...;w]9.v...V...$....L/m.H#..]...G....QQ..'.z.!NW~..R..y....E.)....m.k%....+....>....02../..M....b.l..f7..f?-~_..E.5.~....*.'....8?.n........x...#....9.........q.q.n...\....D.Uv9.9...P.j7P~q9[BV...>C..[F..k-UL(jfT..\..{d.v;.5.e.fb.3^+...Z|]S3G...$..H=.W..c...B...).v.D!...s...+.K...~=..l.2...X.m.-....m0.....p...>...d......e.J..gUr*4....vw.........T.cQ......\...]...Z{..q..n..'Ql.$..V.U9..j 4...9<..6i.....5.F.).k.LQ4.H...2..p.*.bQJ..4.K'C...#.%"q.u../zoXL...L...........'..g11=E.....y.8...~.Oe..X....u.M8.T.....Qq.m.........i....F.4e.([Hm.*...E....2........s. *R..{."4.x.]...-.....xQ@.z.......Bz.).[..C...T..".....q............M.X..CQ..A..........d...`S.3...e.X.....u.>.!..;k...>..

                            C:\Program Files (x86)\Windows NT\locale2.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):56546
                            Entropy (8bit):7.996966859255979
                            Encrypted:true
                            SSDEEP:1536:cWsX30GkPK2rw7bphKKdxDBxjqtalDFMflaX4:cZXhkPhr+TRJqtaK
                            MD5:4CB8B7E557C80FC7B014133AB834A042
                            SHA1:C42E2C861FF3ED0E6A11824E12F67A344E8F783D
                            SHA-256:3EC6A665E7861DC29A393D00EAA00989112E85C6F1B9643CA6C39578AD772084
                            SHA-512:A88E78258F7DB4AECD02F164E6A3AFCF39788E30202CF596F9858092027DDB2FDB66D751013A7ABA5201BFAFF9F2D552D345AFE21C8E1D1425ABBC606028C2E6
                            Malicious:false
                            Preview:7z..'....O; ........2.......D.X..Z.2..7nf..R..s# s..v.f.....%G..>..9..Jh.-j.r..q.2.=v..Q.....SW7....im..|.c...&...,.s....f.h...C.g~..f.7=9...,...sd....iD......cR.^...$..<....nd...S.O..E)0..SQ.AA.C..$.D.|. a.:..5.....b.....2......W.....Z.pS.b/.F.;|`...O/....@.......4.".b.(...4...,..h/.K$..r!...."..`.S...D?.":...n..f.{C..t..,/.S.0.N..M...v...(.Yn..-.)..-...N~....}..).. .j!...1H.7?R..X.....rKi....9.i[k..+.....Br\.=.k.t8...6Lmh.../.V^K.f.......*.@MM..`...,W.......E..v.H....0.W..~....I.....w....<....X.Azl.FH..6\.a..E?=..I.q.5...s...;.,J.0..J.../.w..,..n.EkN..,j....f.y&q.C}fnY..2\......0.....N!.J..H.H0.....BJ.Q..v}=......^c.'w..#...d.T1....#...2s}N.....2.%.?. ....l.).....a<5Y.s....}...2*.#s..]0h..._G....3].....7y.}.B.6...ywE....'q.....h..?p .#..Emm2..F..| .M.Rv!.v.G....1L.Kx...T...".a6.%S0..g..7.......J.vjO.{.A....B@.c.y>}.....N.+....:.L=[....._.....Y.{....F..|.w.oX..t&[.....a\.M..2.Qe.[}L.Ch[...G.S#.$9...8<..W.d1...*PH.`.....4.A.......?..g.

                            C:\Program Files (x86)\Windows NT\locale3.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):31890
                            Entropy (8bit):7.99402458740637
                            Encrypted:true
                            SSDEEP:768:rzwmoD5r754TWCxhazPt9GNgRYpSj3PsQ4yVb595nQ/:vwmolXaT9abVzP1TC
                            MD5:8622FC7228777F64A47BD6C61478ADD9
                            SHA1:9A7C15F341835F83C96DA804DC1E21FDA696BB56
                            SHA-256:4E5C193D58B43630E16B6E86C7E4382B26C9A812D6D28905DD39BC7155FEBEE1
                            SHA-512:71F31079B6C3CE72BC7238560B2CBD012A0285B6A5AC162B18EAE61A059DD3B8DBCF465225E1FB099A1E23ED7BDDF0AAE4ED7C337A10DC20E0FEEC4BC73C5441
                            Malicious:false
                            Preview:.@S......................xi.\ .~.#..:}..fy?koGL^|kH.G...........x....Tg.Y.t....~^..".L.41.....R..|.....R...C.m(.M&...q.v.$..i..U.....).PY.......O.....~..p.u.Y.......{...5^q.|a.]..@DP".`Rz}...|N.uSW.......^..o...U..z...3...bH........p.......Y`..b.t.x.F^i.<.%.r.o..?w.Z..M.fI.!.a...Zsb.+.y..W...n.....;...........|.{.@Q.....#".M...4.A).#;..r...>E..]w{.-....B...........v..`...S...sY....h.Sa)...r.3.U;n8wXq.x...@^z...%8H.Zd._..f~.....u[..q$..%......C..../].rS.....".=..<o.<S....-^"..iIX..r...D.......k.P.e...U..n.]^p..pal....E.c..+..Gc..U?s.R...p...:>..v..o2..B.Hn..q...F..3.o...%.......C......*.V..|..2.J..i.r....|;T.C6).......a..~"K....Y.....]3.{{..N...X>.1.....:?....,..T+=s...............so.;....&....Q.\K..b............k,..#l...Yb...VE.g.3v.$'.H3......w.....{f..e.....PS.tQ..*.8a....5w....\8%..c.;......q.j.t0/.8s..(9....... .S...0.o.o......f*..]....U..>N....Kc/..ka.I"O-O.!./..S".IN .....%G...........x%..ZL`Sq.;.}w.`..k.....F.........Tp..}..?t..

                            C:\Program Files (x86)\Windows NT\locale3.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):31890
                            Entropy (8bit):7.99402458740637
                            Encrypted:true
                            SSDEEP:768:jh43RfBLJT55mgLMoqX3gX/i69sXCuWegxJr8qF88M:qhj+I7qCKNSegPnFM
                            MD5:CE6034AFC63BB42F4E0D6CD897DFBCB8
                            SHA1:49E6E67EB36FE2CCAA42234A1DBB17AA2B1C7CC0
                            SHA-256:7B7EB1D44ED88E7C19A19CEDAA25855F6800B87EC7E76873F3EA4D6A65DAA25F
                            SHA-512:7801FA33C19D6504FF2D84453F4BB810FD579CB0C8772871F7CC53E90B835114D0221224A1743C0F5AAE76C658807CC9B4EC3BEC2CAD4AB8C3FD03203DAA7CF0
                            Malicious:false
                            Preview:7z..'....oYU@|......2.........Z....f..t.#.............tb.7E..Jo.........b.I=.Y..6(..=....^..>i.^E.."q.$&8....N...p+.p. .P.z6.b,.8kdD......'...G.R.n.&5..C..H.E..So!T^n{.a#d....z.SB........Nb.........LO+B ...iV..HH.Cc*.o@|.....Yvxb^.cW....._.........m.}.(V.i.H$....R....`.M.p......A?....._..nb..D.*RT<bUV.n].....LD.qU.....U9....]...h..y!...I....&C......g`...YahZ.q4.{.....2ZRG..f.. .M....:t .........8..Eg.....o.....h.]{..........p...M...lh.@.(R.]!B.:...b78$...b.......hc...C~....I..B<.x_OB|...<. .=NZ.....z........sjJ.....*{<..L.......^...9..^d..$d..}......#.dL'~.}....M...j.(5..@.tcVm.H..-.n...D..&....<..Z...@]./7?...[..qfW..!...v...==..d..M..om~).....C..9....c<..WUV.ed.h...]....OCt(X.H<<:.9..{5j....Nh.L.$..>..D..haP..~...............}r=!.E.ng..........9+...2.g.H3Lx.Bu....]jC...q.g.g.U.4..<........)....oo.T.c_.......X.,.@...nu......D.B(~.5....x5...............4S7B..p...Uk.0-m.VM.M@.V\.o...(......".k..w....Z.([.@.MQ.i9..."W..m...N.,.

                            C:\Program Files (x86)\Windows NT\locale4.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):74960
                            Entropy (8bit):7.99759370165655
                            Encrypted:true
                            SSDEEP:1536:x2PlxAOr0Y07RqyjjkFThaVNwDsKsNFBrFYek36pX4MDVuPFOnfIId+:QAOrf07RHjkFThaVGMLF3hNDcPFOn5s
                            MD5:950338D50B95A25F494EE74E97B7B7A9
                            SHA1:F56A5D6C40BC47869A6AE3BC5217D50EA3FC1643
                            SHA-256:87A341B968B325090EF90DFB6D130ED0A1550A1EBDE65B1002E401F1F640854A
                            SHA-512:9A6CC00276564DDE23D4CABA133223D31D9DDD06D8C5B398F234D5CE03774ED7B9C7D875543E945A5B3DB2851EC21332FE429A56744A9CC2157436400793FF83
                            Malicious:false
                            Preview:.@S........................F.T....r...z'I.N..].u.e.e..y.....<|r.:v.....J.i...L.Sv.....Nz..,..K.sI*./.d.p.'.R.....6eF....W{."J.Nt'.{E....mU_..qc.G..M..y.QF)..N..W.o.D!.-...A$.....Nc.(...~.5.9'..>...E..>.5n..s..W.A7..../..+..E.....v..^&.....V..H6..j..S`H.qAG.R.i^&....>@SYz.@......q.....\t=.HE...i..".u.Z.(y.m..3.0\..Wq9#.....iH7..TL.U..3,b........L...D..,..t(mS..06...[6.y....0-....f.N7..R......./..z.bEQ.r..n.CmB'..@......(...l..=.s........`.6.?..[mzl....K.5"..#*.>.~..._...A.%b..........PnI.T...?R~JL<.$V..-.U..}\..t/F..<..t....y(K..v..6"..'.!.*z.R....EJ0.d<v:.R&......x...2....;Tc..(..dW...7a.)...rq.....{"h.wbB..t)f..qj........~.XR.a/........l./.S......".%?.C.cL._.,k.n'....a./.z...{.]...<......._pFP..d..,......Q...[........3...Kq).rJ..8..I.)o...i'Q..=......(dq(.m../..%=.......r m.X|3.......b.~tA.......%+.T..E@..ce...%....,..x#...,....-....A...q.....r.+...?......L..%.c.... ..>.Iw......P...O)...$`.'..D1.r.....*..9;..R...VL.]..%j.....TM.4.....P.L...

                            C:\Program Files (x86)\Windows NT\locale4.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):74960
                            Entropy (8bit):7.997593701656546
                            Encrypted:true
                            SSDEEP:1536:xsn0ayGU0SfvuEykcv5ZUi4Q9POZBgfmWRDOs2XwV1NN4+8wbr82nR+2R:xY0ntfvwkcv5ZwYPCBgfmW/VDS+FbrLN
                            MD5:059BA7C31F3E227356CA5F29E4AA2508
                            SHA1:FA3DC96A3336903ED5E6105A197A02E618E3F634
                            SHA-256:1CBF36AFC14ECC78E133EBEC8A6EE1C93DEA85EEC472CE0FB0B57D3E093F08CC
                            SHA-512:E2732D3E092B0A7507653A4743E1FE7A1010A20D4973C209BA7C0B2B79F02DF3CFDB4D7CE1CBFB62AA0C3D2CDE468FC2C78558DA4FF871660355E71DC77D8219
                            Malicious:false
                            Preview:7z..'....G8{p$......@..........0..$D.#'7..^..G.....W.K^.IC;.k...)_...S...2..x.....?(..Rj.g.......B...C..NK.B0s..L?.$..].....$r..E.]~...~K..E..3.......t..k..J......B...4.?!..6r.Qqc.5.r...\..,A.JF.J...Vb..b...M.=^.K7..e..]...X.%^3T...D.y..e2..>...k...\...S.C....')......hhV..K...z4..$d....a[.....6.&.D.:.=^.8.M[....n..i[....]..Y.4...NpkjU..;..W5.#.p.8?u....!.......u.[?.$..^.}f.A..G.N...b7.*...!!.(.....Gc..........Dg....Z.*.#.\".e.m.).t.5..r...6"....Q......fx..W......k..K7^."C.4*Z.{.^WG.....Z..P......Z....7R.....5hy...s....b.....7.V.....k.=.y.i.i......Y.......FY$.|T.5..V...E|...q.........].}bl...y.....;...q....-a..RP3..L~k....|..p_......."......rJz."..v......Z....l1.O.N...Di...O.:m.X...W.......x..}..>ktk.,.~...n-.m..`...G......$.....].lPx..<..9.m4.n...d....G...{'.a........u).R.+.....y.`.p...1@..!..b...J.W..Vt,......h...k....W.,..@Sd.<ZG......}&.R.]p(Y...o...r.4m:.J`.U..S5.iN...^!Y..hHP.B.58....JvB.K.k;...4........\.6=&erz..2..&...Z.C...h_.

                            C:\Program Files (x86)\Windows NT\locale7.bin

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):29730
                            Entropy (8bit):7.994290657653607
                            Encrypted:true
                            SSDEEP:768:e7fyvDZi63BuPi2zBBMqUp6fJzwyQb91SPlssLK4:AfKNiG/2vMx6fJzwVb2tss7
                            MD5:2C3E0D1FB580A8F0855355CC7D8D4F7A
                            SHA1:177E4A0B7C4BC8ACE0F46127398808E669222515
                            SHA-256:9818FEBDE34D7E9900EB1C7A32983CA60C676BE941E2BC1ED9FBD5A187C6F544
                            SHA-512:B9410FC8F5BE02130D50E7389F9A334DD2F2A47694E88FBB9FB4561BD3296F894369B279546EEBB376452DF795C39D87A67C6EE84C362F47FA19CF4C79E5574E
                            Malicious:false
                            Preview:.@S....*z.p,..................kcn..a.^.<..=......7`....6..!`...W.,2u...K.r.1.......1...g<wkw.....q..VfaR...n.h.0b[.h.V$..7.7'd.....T.....`.....)k.....}..........bW'.t..@*.%e5....#.6.g.R.......,W....._..G.d...1..e/...e7....E.....b....#Z,#...@.J.j?....q.ZR.c.b.V....Y-.......3..&E...a.2vg$..z...M9.[......_.1U....A...L.0+3U.[)8...D........5......[..-.u...ib...[..I-....#|j..d..D.S.'.....J.`.....b..y...Iu.D.....2.r}.4....<K.%....0X..X[5.sD...Xh.(G...Z;.."..o..%.......,.y..\..M6.+,.]c..t.:.|...p%.../1%.{>..r..B..yA.......}.`.#.X....Rl`.6\~k.P8..C....V\^..2.7...... h. .>....}..u)..4..w..............^N...@.v....d.P...........IA.. G?..YJ>._La..Y.@.8N.a...BK.....x.T....u.....\x.t...~.2p.M..+.R&w.......7c!v.@..RGf.F.>^+.b=........@l.T5.:........#}.%>.-.C.[XR.TG.\..'....MH..x..Y...cL........y.>....%...:.S.W^..k.EE.5O`.6<5-kh_...."95..:p....P.jk`....b.7.Z.8Y....H(j2y..`d.q;RyZ.5$..3.;......0,......+O.....L.,..u.s....S.1o.g...l"..e.....Cy<....I.+..B@......~.0...<.

                            C:\Program Files (x86)\Windows NT\locale7.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):29730
                            Entropy (8bit):7.994290657653608
                            Encrypted:true
                            SSDEEP:768:0AnbQm4/4qQyDC44LY4VfQ8aN/DObt1dSt3OUqZNKME:0ab6c4oY0aBDObjot+Uqu7
                            MD5:A9C8A3E00692F79E1BA9693003F85D18
                            SHA1:5ED62E15A8AC5D49FD29EF2A8DC05D24B2E0FC1F
                            SHA-256:B88E3170EC6660651AF1606375F033F42D3680E4365863675D0E81866E086CC3
                            SHA-512:8354B80622A9808606F1751A53F865C341FF2CE1581B489B50B1181DAA9B2C0A919F94137F47898A4529ECCCD96C43FCCD30BCDF6220FA4017235053AF0B477D
                            Malicious:false
                            Preview:7z..'....G..s......2......../.....h..f...H=...v.:..Q.I..OP.....p..qfX.M.J..).9;...sp......ns./..;w....3.<..m..M.L...k..L..h[-Dnt.*'5....M(w%...HVL..F&......a...R.........SF.2....m@X&X5.!....ER......]xm.....\.....=.q.I.}v.l#.B........:.e....b6.l.d..O......H.C..$.',.B..Q\..\.B.%...g...3?.....*.XuE.J.6`.../...W.../......b..HL?...E.V[...^.~.&..I,..xUH..2V..H..$..;.....c.6.o........g.}.u:.X....9...|Ynic.*.....ooK..>..M~yb..0W....^..J(S......Q?...#.i.1..#.._.9..2E.S7c.....{..'...j.A.p......dS]......i.!..YS...%.Q<..\.0.....FNw....e...2...$..$4..Pv.R...mv...-.b.T.)..r*..!..).n4.+.l[.N...4qN....w.B..[......<U.etA.A....SB..^y.......^0.f._.&..Z.zV.%.R.f_dz.,E..JJ..%.R.7.3m.:..;.`...AoHLHC..|..)f...C....$...E....H"x..F....wW...3"......Y.*Y.....5....,E...tn.KS...2......w\Z..1.".O.=+..A...2.....A.........k. c..../2..i!q..q...u.'.m.6.j.\.....x...S....$....*.&(.).^..f.d.g"j..#^....W.]{.C.?2Z.'X...5.._@..q.j..Xb...n{1..<.i...'r...7'.F.L\(.8

                            C:\Program Files (x86)\Windows NT\res.dat

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:7-zip archive data, version 0.4
                            Category:dropped
                            Size (bytes):2410545
                            Entropy (8bit):7.999922598249242
                            Encrypted:true
                            SSDEEP:49152:nLUmXREr6h9uO2l7gP53OuCh+FTUwUQ3uUQ/tcLaSD2+S+PJwygoB:phW6h9vs7gPNOB+FTU8/QVbSDtRwyJB
                            MD5:05396EF5B04CF7708E0B2457EEC78612
                            SHA1:8B60DB96BA19ED35FE4815D59812DAF2E0DA42AD
                            SHA-256:600861E4C0354456CC76021E20F16EA49D9BBB6C9E7AFB808AAA4077FE9235DE
                            SHA-512:FB7DF5B5852FB978EAF7904752A530C91F2AB703E0D973A038173FC15DFBD9C140F0D02DA57BA90C7BEEB22AF2335D14011215578E0D200548AD1CDA8B1CB2ED
                            Malicious:false
                            Preview:7z..'....3. ..$.....A..........l...5"]%..J..n.$...x*...........H.=...D.%.OrO....<.M..}..e..t.8[(t...(.u...Oi .......R.t..a...2+L>...A]a...A..}...~....S#p.HO.......#.".k)...3.w...d8.....r.p...[..F.0m....FEi..K.h|...F..}..5..._>..HF..h,!....:.&k......:./F.`..v.zeGD"\f]..U..\........B.w....a......"#..z.6......V Jh.[_....v...GQ5x.....Q....#...,ce...q].!w>....?@Wn*j.m...A....O.4.-.+.k..g.;....$...p.tx.......q..HWy..\....2..(Ew..p...s!.y...........M..........9.0.2...Q.M..U|ck...5A.%...|7]@V...H..W..././d.......,.........C.#.d._4K.Lo.'p.."G..hg.6$o..^.lYg.;..8~...kB..YX.5.+8.]L.o.T.......6..>mb.......WE.S8..;{.o`..r..T$2.S...wk(R... &<.4.......yZ.!z6..|.......iep..$...Ch......,..6...v.1E....]O .....\L.....1..=3..1z.(^....U.c....t.........L...-?......|..w.x.9H...-.5d....n..b..s.S...V):...ci..!=+...2.7.u..E.\1.\n.1C.S........O.W<./G.G..R0..m*.....HN...N@"^.~#(.-...va.{E.Ph...[..W.$....sb..+.nhn}W-...Bu"....tn. .....IRAxuU. ...j...e.C..7*.<....?.k

                            C:\Program Files (x86)\Windows NT\tProtect.dll

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:PE32+ executable (native) x86-64, for MS Windows
                            Category:dropped
                            Size (bytes):63640
                            Entropy (8bit):6.482810107683822
                            Encrypted:false
                            SSDEEP:768:4l2NchwQqrK3SBq3Xf2Zm+Oo1acHyKWkm9loSZVHT4yy5FPSFlWd/Ce34nqciC50:kgrFq3OVgUgla/4nqy5K2/zW
                            MD5:B4EAACCE30F51EAF2A36CEA680B45A66
                            SHA1:94493D7739C5EE7346DA31D9523404D62682B195
                            SHA-256:15E84D040C2756B2D1B6C3F99D5A1079DC8854844D3C24D740FAFD8C668E5FB9
                            SHA-512:16F46ABE2DD8C1A95705C397B0A5A0BC589383B60FE7C4F25503781D47160C0D68CBA0113BA918747115EF27A48AB7CA7F56CC55920F097313A2DA73343DF10B
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 9%
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.[.7.5N7.5N7.5N7.4NX.5NA'NN4.5NA'HN5.5N.|XN4.5N.|HN6.5NA'XN6.5N.|DN0.5N.|IN6.5N.|MN6.5NRich7.5N........................PE..d....(gK..........".........."............................................... ..............................................................d...(........................(.......... ................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..0...........................@..B................................................................................................................................................................................................................

                            C:\Program Files (x86)\Windows NT\task.xml

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):3.339114067706043
                            Encrypted:false
                            SSDEEP:48:dXKLzDlnFL6w0QldOVQOj933ODOiTdKbKsz72eW+5y4:dXazDln8whldOVQOj6dKbKsz7
                            MD5:F975D398F27F6D83FB489A1081571935
                            SHA1:F288955EDB090D71EC2643D43F3765B2831E0FB3
                            SHA-256:CFD5D65781809E9C9812031522218D18F72D04D32508C1B159898577158C4D7D
                            SHA-512:3A01956CE56F88F34A16EBCA7C9BA05459DA94BD7E4B1F25FB832A845758A34A6B6DCE92BA874B30ADA387D0C9EB83DD6CA3D657ECF60FDE5FA55510F7020CA1
                            Malicious:false
                            Preview:<Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2005-10-11T13:21:17-08:00</Date>. <Author>Microsoft Corporation</Author>. <Version>1.0.0</Version>. <Description>Microsoft</Description>. <URI>\kafanbbs</URI>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user</UserId>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="System">. <UserId>user</UserId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvaila

                            C:\Program Files (x86)\Windows NT\trash

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):2160403
                            Entropy (8bit):7.999915137888149
                            Encrypted:true
                            SSDEEP:49152:It2n0GjjLAmAsqpaBu1j6HHY98iLNC9s0GSUCrtIQ:fImVwassHHeLmGSPtIQ
                            MD5:0CEBF47D80812A6BAC25DBB7BBD2A4BA
                            SHA1:60C7165E374A09465A6864964E6FCE777A6A397E
                            SHA-256:A3783734750CAE6E97CF1A2FAA2E8716B6C91A9F1D05C23C1370969D01772353
                            SHA-512:D39E65CD10D767937907F1EDD1AA6F1F0D73D83F852635A10C4809C0161D0634C3E8764DD019CB19DEEC7D299D5268D27154997F05675B0E061D0D1C6AC8EB8D
                            Malicious:false
                            Preview:.U_O..h...=...`.f5...........3...._E..M...A.P..)....8.&>..9...Uye..,.X$.^.T...$...\2.uz>H.>E........B#..y..0...k`..C..!.."}.~)..X..gR.P.....E.@l...Tr...._m..m..Pv.....7?A.Z.o#..I>..)S.1.+...........j.L.b....B.2..T. `e_..d:m.~..B..hw..S............YS..:.v`}..%...1.c.H.W.....Y....\..q....$4..+jN.,q...ra.....v*".J$.9.. .}k<..cC...k%7.i+~`.....g.......m.`.3z.......tQxf...vJ:zpV..<..oi)...C....a.G.]...@E]../h..0.e.B..u......@\%.E...T..w....O...3$j.7TTK.?]a..1^/g...05;D. ...Y.&..!......f!.V.......).M..n..].[hu.).....Mc.$l}Db....\..W`...R..0.......)"....n.WR..Y.O...".r.._..>...b.z..d.......w8.,v...9.l.R.U\{..=.}.g.@........Ut.3..Y.....m.....yKz..S?.q..P.qs...il.mN<L..-]m...P..0.z\.`#]....hQL.<...\.Xa.;..V.!.....cJx.\..!t;5< E.&C.~ ;$.u..z..Ay8......#..=.+.....P..B/.'(J..L..hR.h..H.3."..&.!.{.q.*....(.06...............6...........G.Oe......e=.2:AK."o#}>||...!.C....n....M...7....u..=..!..~.. ......N..[Me;OFj.....^V..X5.9}#..Y&.*..".[.`...

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):64
                            Entropy (8bit):1.1940658735648508
                            Encrypted:false
                            SSDEEP:3:NlllulVmdtZ:NllUM
                            MD5:013016A37665E1E37F0A3576A8EC8324
                            SHA1:260F55EC88E3C4D384658F3C18C7FDEF202E47DD
                            SHA-256:20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
                            SHA-512:99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
                            Malicious:false
                            Preview:@...e................................................@..........

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jiv1z5c.eg5.psm1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kf54lnsk.kag.psm1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nl0globk.rqv.ps1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zf3rxwz5.yku.ps1

                            Download File
                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):60
                            Entropy (8bit):4.038920595031593
                            Encrypted:false
                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                            Malicious:false
                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                            C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\_isetup\_setup64.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:PE32+ executable (console) x86-64, for MS Windows
                            Category:dropped
                            Size (bytes):6144
                            Entropy (8bit):4.720366600008286
                            Encrypted:false
                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                            Malicious:false
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 0%
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-0SINS.tmp\update.vac

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3606016
                            Entropy (8bit):7.0063494494702985
                            Encrypted:false
                            SSDEEP:49152:/MifTj964EMRY42Kgq7eJEJqx2dhZe71MzuiehWIKxZfAtbyBSfbZmSKiyQF:/M+jcZ42KXw2dhZe71MzSRFyBSDH
                            MD5:95ACD5631A9131DB1FD066565AFC9A67
                            SHA1:8E9473BD632FF0F57FC34EECAC17174341D80D94
                            SHA-256:EA6B71519CD54AB523B822F84D5D4E5B305214DA4C37E96A02D8BC1CB182F58B
                            SHA-512:70188E7AD6B0D9DA5E88EEFC6095F99066F73FDAB10F084E3F2F96B30D8A717BAE75E9C1B476FB996BC86B9A753AAF26F96024D0068090B437EACE6E5BE35681
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 24%
                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Fig...........!.....h....................................................7...........@.........................XC.......J..<....07.X....................@7..?...................................................K...............................text....f.......h.................. ..`.rdata..T............l..............@..@.data................b..............@....00cfg.......`(......"(.............@..@.tls.........p(......$(.............@....voltbl.F.....(......&(..................#.q....P.....(......((............. ..`.rsrc...X....07.......6.............@..@.reloc...?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\_isetup\_setup64.tmp

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:PE32+ executable (console) x86-64, for MS Windows
                            Category:dropped
                            Size (bytes):6144
                            Entropy (8bit):4.720366600008286
                            Encrypted:false
                            SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                            MD5:E4211D6D009757C078A9FAC7FF4F03D4
                            SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                            SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                            SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                            Malicious:false
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 0%
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-64MMK.tmp\update.vac

                            Download File
                            Process:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3606016
                            Entropy (8bit):7.0063494494702985
                            Encrypted:false
                            SSDEEP:49152:/MifTj964EMRY42Kgq7eJEJqx2dhZe71MzuiehWIKxZfAtbyBSfbZmSKiyQF:/M+jcZ42KXw2dhZe71MzSRFyBSDH
                            MD5:95ACD5631A9131DB1FD066565AFC9A67
                            SHA1:8E9473BD632FF0F57FC34EECAC17174341D80D94
                            SHA-256:EA6B71519CD54AB523B822F84D5D4E5B305214DA4C37E96A02D8BC1CB182F58B
                            SHA-512:70188E7AD6B0D9DA5E88EEFC6095F99066F73FDAB10F084E3F2F96B30D8A717BAE75E9C1B476FB996BC86B9A753AAF26F96024D0068090B437EACE6E5BE35681
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 24%
                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Fig...........!.....h....................................................7...........@.........................XC.......J..<....07.X....................@7..?...................................................K...............................text....f.......h.................. ..`.rdata..T............l..............@..@.data................b..............@....00cfg.......`(......"(.............@..@.tls.........p(......$(.............@....voltbl.F.....(......&(..................#.q....P.....(......((............. ..`.rsrc...X....07.......6.............@..@.reloc...?...@7..@....6.............@..B................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp

                            Download File
                            Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe
                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3366912
                            Entropy (8bit):6.5305633078734635
                            Encrypted:false
                            SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                            MD5:65559DDD30465F50270FB7E9EE6E6C7C
                            SHA1:0645894756C448F9DE22FAE9E65EF1DA36FE63CE
                            SHA-256:EABC186313A00D4795DA37132F1549C754E093E9B1B6D706AAD01528AE5D986F
                            SHA-512:B858B63FD23F75D114DA89B79B94272679110F5D149890783CB28960A23299F22CE723918CAFCD4FAC3198C59A2AE32787E6C08A1CBF1AC69C789361662CF43D
                            Malicious:true
                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                            C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp

                            Download File
                            Process:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe
                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):3366912
                            Entropy (8bit):6.5305633078734635
                            Encrypted:false
                            SSDEEP:98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
                            MD5:65559DDD30465F50270FB7E9EE6E6C7C
                            SHA1:0645894756C448F9DE22FAE9E65EF1DA36FE63CE
                            SHA-256:EABC186313A00D4795DA37132F1549C754E093E9B1B6D706AAD01528AE5D986F
                            SHA-512:B858B63FD23F75D114DA89B79B94272679110F5D149890783CB28960A23299F22CE723918CAFCD4FAC3198C59A2AE32787E6C08A1CBF1AC69C789361662CF43D
                            Malicious:true
                            Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*...........*.......*...@..........................04...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

                            \Device\ConDrv

                            Download File
                            Process:C:\Program Files (x86)\Windows NT\7zr.exe
                            File Type:ASCII text, with CRLF, CR line terminators
                            Category:dropped
                            Size (bytes):406
                            Entropy (8bit):5.117520345541057
                            Encrypted:false
                            SSDEEP:6:AMpUMcvtFHcAxXF2SaioBGWOSTIPAiTVHsCgN/J2+ebVcdsvUGrFfpap1tNSK6n:pCXVZRwXkWDThGHs/JldsvhJA1tNS9n
                            MD5:9200058492BCA8F9D88B4877F842C148
                            SHA1:EED69748A26CFAF769EF589F395A162E87005B36
                            SHA-256:BAFB8C87BCB80E77FF659D7B8152145866D8BD67D202624515721CBF38BA8745
                            SHA-512:312AB0CBA3151B3CE424198C0855EEE39CC06FC8271E3D49134F00D7E09407964F31D3107169479CE4F8FD85D20BBD3F5309D3052849021954CD46A0B723F2A9
                            Malicious:false
                            Preview:..7-Zip (a) 23.01 (x86) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20....Scanning the drive for archives:.. 0M Scan. .1 file, 31890 bytes (32 KiB)....Extracting archive: locale3.dat..--..Path = locale3.dat..Type = 7z..Physical Size = 31890..Headers Size = 354..Method = LZMA2:16 LZMA:16 BCJ2 7zAES..Solid = -..Blocks = 1.... 0%. .Everything is Ok....Size: 63640..Compressed: 31890..

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Entropy (8bit):7.956049914920317
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 98.04%
                            • Inno Setup installer (109748/4) 1.08%
                            • InstallShield setup (43055/19) 0.42%
                            • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                            • Win16/32 Executable Delphi generic (2074/23) 0.02%
                            File name:#U5b89#U88c5#U52a9#U624b2.0.6.exe
                            File size:8'206'704 bytes
                            MD5:c5c5262b26879c84d470ef4a5b73663d
                            SHA1:c907618ac1db8f8186469e0bcfff2debc0b49fdd
                            SHA256:b53886e5499226b7565d65fd25ecd448f82434cac355d799ea2e39e0d822b234
                            SHA512:5a859f9164d18ba5cf9dfc109e7c0b024cc30d18ab03d109ec950529c7b3a7a782db19159c6d353567c4d12cf2a83d894af251848bdc20b04a36129a25b397df
                            SSDEEP:98304:XwRE36w8t6MocqxphH99gaAEglulhqv8om22U2t9+/LQdHMeiTNmJaSj5wylhNbv:lGt8jxP99PF6vXG01TUASjbLjn
                            TLSH:2C862223F2CBE13DE45A0B3B05B2A55894FB6A216823AD5396ECB4ECCF351501D3E647
                            File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                            File Icon

                            Icon Hash:0c0c2d33ceec80aa

                            Static PE Info

                            General

                            Entrypoint:0x4a83bc
                            Entrypoint Section:.itext
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                            Time Stamp:0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:6
                            OS Version Minor:1
                            File Version Major:6
                            File Version Minor:1
                            Subsystem Version Major:6
                            Subsystem Version Minor:1
                            Import Hash:40ab50289f7ef5fae60801f88d4541fc

                            Entrypoint Preview

                            Instruction
                            push ebp
                            mov ebp, esp
                            add esp, FFFFFFA4h
                            push ebx
                            push esi
                            push edi
                            xor eax, eax
                            mov dword ptr [ebp-3Ch], eax
                            mov dword ptr [ebp-40h], eax
                            mov dword ptr [ebp-5Ch], eax
                            mov dword ptr [ebp-30h], eax
                            mov dword ptr [ebp-38h], eax
                            mov dword ptr [ebp-34h], eax
                            mov dword ptr [ebp-2Ch], eax
                            mov dword ptr [ebp-28h], eax
                            mov dword ptr [ebp-14h], eax
                            mov eax, 004A2EBCh
                            call 00007FC204E9B9D5h
                            xor eax, eax
                            push ebp
                            push 004A8AC1h
                            push dword ptr fs:[eax]
                            mov dword ptr fs:[eax], esp
                            xor edx, edx
                            push ebp
                            push 004A8A7Bh
                            push dword ptr fs:[edx]
                            mov dword ptr fs:[edx], esp
                            mov eax, dword ptr [004B0634h]
                            call 00007FC204F2D35Bh
                            call 00007FC204F2CEAEh
                            lea edx, dword ptr [ebp-14h]
                            xor eax, eax
                            call 00007FC204F27B88h
                            mov edx, dword ptr [ebp-14h]
                            mov eax, 004B41F4h
                            call 00007FC204E95A83h
                            push 00000002h
                            push 00000000h
                            push 00000001h
                            mov ecx, dword ptr [004B41F4h]
                            mov dl, 01h
                            mov eax, dword ptr [0049CD14h]
                            call 00007FC204F28EB3h
                            mov dword ptr [004B41F8h], eax
                            xor edx, edx
                            push ebp
                            push 004A8A27h
                            push dword ptr fs:[edx]
                            mov dword ptr fs:[edx], esp
                            call 00007FC204F2D3E3h
                            mov dword ptr [004B4200h], eax
                            mov eax, dword ptr [004B4200h]
                            cmp dword ptr [eax+0Ch], 01h
                            jne 00007FC204F340CAh
                            mov eax, dword ptr [004B4200h]
                            mov edx, 00000028h
                            call 00007FC204F297A8h
                            mov edx, dword ptr [004B4200h]

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                            IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xcb0000x11000.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xba0000x10fa8.reloc
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .reloc0xba0000x10fa80x11000a85fda2741bd9417695daa5fc5a9d7a5False0.5789579503676471data6.709466460182023IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                            .rsrc0xcb0000x110000x1100085eb1c4931e9d0b4430fde2d42f1c51bFalse0.187744140625data3.723418370548741IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                            Resources

                            NameRVASizeTypeLanguageCountryZLIB Complexity
                            RT_ICON0xcb6780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                            RT_ICON0xcc0e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                            RT_ICON0xcc7480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                            RT_ICON0xcca300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                            RT_ICON0xccb580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                            RT_ICON0xce1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                            RT_ICON0xcf0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                            RT_ICON0xcf8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                            RT_ICON0xcfe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                            RT_ICON0xd11200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                            RT_ICON0xd53480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                            RT_ICON0xd78f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                            RT_ICON0xd89980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                            RT_STRING0xd8e000x3f8data0.3198818897637795
                            RT_STRING0xd91f80x2dcdata0.36475409836065575
                            RT_STRING0xd94d40x430data0.40578358208955223
                            RT_STRING0xd99040x44cdata0.38636363636363635
                            RT_STRING0xd9d500x2d4data0.39226519337016574
                            RT_STRING0xda0240xb8data0.6467391304347826
                            RT_STRING0xda0dc0x9cdata0.6410256410256411
                            RT_STRING0xda1780x374data0.4230769230769231
                            RT_STRING0xda4ec0x398data0.3358695652173913
                            RT_STRING0xda8840x368data0.3795871559633027
                            RT_STRING0xdabec0x2a4data0.4275147928994083
                            RT_RCDATA0xdae900x10data1.5
                            RT_RCDATA0xdaea00x310data0.6173469387755102
                            RT_RCDATA0xdb1b00x2cdata1.2045454545454546
                            RT_GROUP_ICON0xdb1dc0xbcdataEnglishUnited States0.6170212765957447
                            RT_VERSION0xdb2980x584dataEnglishUnited States0.2797450424929179
                            RT_MANIFEST0xdb81c0x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                            Imports

                            DLLImport
                            kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                            comctl32.dllInitCommonControls
                            user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                            oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                            advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                            Exports

                            NameOrdinalAddress
                            __dbk_fcall_wrapper20x40fc10
                            dbkFCallWrapperAddr10x4b063c

                            Possible Origin

                            Language of compilation systemCountry where language is spokenMap
                            EnglishUnited States

                            Network Behavior

                            ⊘No network behavior found

                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:07:03:11
                            Start date:24/12/2024
                            Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe"
                            Imagebase:0x180000
                            File size:8'206'704 bytes
                            MD5 hash:C5C5262B26879C84D470EF4A5B73663D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:2
                            Start time:07:03:11
                            Start date:24/12/2024
                            Path:C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\AppData\Local\Temp\is-BOUK3.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$20434,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe"
                            Imagebase:0xa00000
                            File size:3'366'912 bytes
                            MD5 hash:65559DDD30465F50270FB7E9EE6E6C7C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:3
                            Start time:07:03:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):false
                            Commandline:"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"
                            Imagebase:0x7ff760310000
                            File size:452'608 bytes
                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:4
                            Start time:07:03:12
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:5
                            Start time:07:03:12
                            Start date:24/12/2024
                            Path:C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENT
                            Imagebase:0x180000
                            File size:8'206'704 bytes
                            MD5 hash:C5C5262B26879C84D470EF4A5B73663D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:false

                            General

                            Target ID:6
                            Start time:07:03:13
                            Start date:24/12/2024
                            Path:C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\AppData\Local\Temp\is-OODAG.tmp\#U5b89#U88c5#U52a9#U624b2.0.6.tmp" /SL5="$30452,7252309,845824,C:\Users\user\Desktop\#U5b89#U88c5#U52a9#U624b2.0.6.exe" /VERYSILENT
                            Imagebase:0xbe0000
                            File size:3'366'912 bytes
                            MD5 hash:65559DDD30465F50270FB7E9EE6E6C7C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:Borland Delphi
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:7
                            Start time:07:03:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:8
                            Start time:07:03:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:9
                            Start time:07:03:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:10
                            Start time:07:03:15
                            Start date:24/12/2024
                            Path:C:\Program Files (x86)\Windows NT\7zr.exe
                            Wow64 process (32bit):true
                            Commandline:7zr.exe x -y res.dat -pad8dtyw9eyfd9aslyd9iald
                            Imagebase:0x750000
                            File size:831'200 bytes
                            MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Antivirus matches:
                            • Detection: 0%, ReversingLabs
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:11
                            Start time:07:03:15
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:12
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Program Files (x86)\Windows NT\7zr.exe
                            Wow64 process (32bit):true
                            Commandline:7zr.exe x -y locale3.dat -pasfasdf79yf9layslofs
                            Imagebase:0x750000
                            File size:831'200 bytes
                            MD5 hash:84DC4B92D860E8AEA55D12B1E87EA108
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:13
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:14
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:15
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:16
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:17
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:18
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:19
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:20
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:21
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:22
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:23
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                            Imagebase:0x7ff72d8c0000
                            File size:496'640 bytes
                            MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                            Has elevated privileges:true
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Has exited:false

                            General

                            Target ID:24
                            Start time:07:03:17
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:25
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:26
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:27
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:28
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:29
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:30
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:31
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:32
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:33
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:34
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:35
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:36
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:37
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:38
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:39
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:40
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:41
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:42
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:43
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:44
                            Start time:07:03:18
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:45
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:46
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:47
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:48
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:49
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:50
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:51
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:52
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:53
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:54
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:55
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:56
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:57
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:58
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:59
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:60
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:61
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:62
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:63
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:64
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:65
                            Start time:07:03:19
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:66
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:67
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:68
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:69
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:70
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:71
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:72
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:73
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:74
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:75
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:76
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:77
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:78
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:79
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:80
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:81
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:82
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:83
                            Start time:07:03:20
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:84
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:85
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:86
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:87
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:88
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:89
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:90
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:91
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:92
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:93
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:94
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:95
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:96
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:97
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:98
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:99
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:100
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:101
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:102
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:103
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:104
                            Start time:07:03:21
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:105
                            Start time:07:03:22
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:106
                            Start time:07:03:22
                            Start date:24/12/2024
                            Path:C:\Windows\System32\sc.exe
                            Wow64 process (32bit):false
                            Commandline:sc start CleverSoar
                            Imagebase:0x7ff6a7210000
                            File size:72'192 bytes
                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:107
                            Start time:07:03:22
                            Start date:24/12/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff70f010000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            General

                            Target ID:108
                            Start time:07:03:22
                            Start date:24/12/2024
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:cmd /c start sc start CleverSoar
                            Imagebase:0x7ff674ad0000
                            File size:289'792 bytes
                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Has exited:true

                            Disassembly

                            Reset < >

                              Execution Graph

                              Execution Coverage:1.8%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:15.8%
                              Total number of Nodes:778
                              Total number of Limit Nodes:10
                              execution_graph 88404 6cc64a27 88405 6cc64a5d _strlen 88404->88405 88406 6cc7639e 88405->88406 88407 6cc65b6f 88405->88407 88408 6cc65b58 88405->88408 88412 6cc65b09 _Yarn 88405->88412 88536 6cde06a0 18 API calls 2 library calls 88406->88536 88411 6cdd6fb3 std::_Facet_Register 4 API calls 88407->88411 88522 6cdd6fb3 88408->88522 88411->88412 88495 6cdcb430 88412->88495 88415 6cc65bad std::ios_base::_Ios_base_dtor 88415->88406 88419 6cc69ba5 std::ios_base::_Ios_base_dtor _Yarn _strlen 88415->88419 88501 6cdd5560 CreateProcessA 88415->88501 88416 6cdd6fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 88416->88419 88417 6cdcb430 2 API calls 88417->88419 88418 6cc6a292 Sleep 88427 6cc69bb1 std::ios_base::_Ios_base_dtor _Yarn _strlen 88418->88427 88419->88406 88419->88416 88419->88417 88419->88418 88426 6cc6e619 88419->88426 88420 6cc66624 88423 6cdd6fb3 std::_Facet_Register 4 API calls 88420->88423 88421 6cc6660d 88422 6cdd6fb3 std::_Facet_Register 4 API calls 88421->88422 88431 6cc665bc _Yarn _strlen 88422->88431 88423->88431 88424 6cc661cb _strlen 88424->88406 88424->88420 88424->88421 88424->88431 88425 6cc763b2 88537 6cc515e0 18 API calls std::ios_base::_Ios_base_dtor 88425->88537 88439 6cc6f243 CreateFileA 88426->88439 88427->88406 88427->88419 88427->88425 88428 6cc69bbd GetCurrentProcess TerminateProcess 88427->88428 88438 6cdd6fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 88427->88438 88460 6cdd5ed0 104 API calls 88427->88460 88494 6cdd5560 CreateProcessA WaitForSingleObject CloseHandle CloseHandle 88427->88494 88428->88419 88430 6cc764f8 88431->88425 88432 6cc66970 88431->88432 88433 6cc66989 88431->88433 88436 6cc66920 _Yarn 88431->88436 88434 6cdd6fb3 std::_Facet_Register 4 API calls 88432->88434 88435 6cdd6fb3 std::_Facet_Register 4 API calls 88433->88435 88434->88436 88435->88436 88505 6cdd5ed0 88436->88505 88438->88427 88451 6cc6f2a7 88439->88451 88440 6cc66dd2 88443 6cdd6fb3 std::_Facet_Register 4 API calls 88440->88443 88441 6cc66dbb 88442 6cdd6fb3 std::_Facet_Register 4 API calls 88441->88442 88454 6cc66d69 _Yarn _strlen 88442->88454 88443->88454 88444 6cc702ca 88445 6cc669d6 std::ios_base::_Ios_base_dtor _strlen 88445->88406 88445->88440 88445->88441 88445->88454 88446 6cc67427 88448 6cdd6fb3 std::_Facet_Register 4 API calls 88446->88448 88447 6cc67440 88449 6cdd6fb3 std::_Facet_Register 4 API calls 88447->88449 88450 6cc673da _Yarn 88448->88450 88449->88450 88453 6cdd5ed0 104 API calls 88450->88453 88451->88444 88452 6cc702ac GetCurrentProcess TerminateProcess 88451->88452 88452->88444 88455 6cc6748d std::ios_base::_Ios_base_dtor _strlen 88453->88455 88454->88425 88454->88446 88454->88447 88454->88450 88455->88406 88456 6cc67991 88455->88456 88457 6cc679a8 88455->88457 88465 6cc67940 _Yarn _strlen 88455->88465 88458 6cdd6fb3 std::_Facet_Register 4 API calls 88456->88458 88459 6cdd6fb3 std::_Facet_Register 4 API calls 88457->88459 88458->88465 88459->88465 88460->88427 88461 6cc67de2 88464 6cdd6fb3 std::_Facet_Register 4 API calls 88461->88464 88462 6cc67dc9 88463 6cdd6fb3 std::_Facet_Register 4 API calls 88462->88463 88466 6cc67d7c _Yarn 88463->88466 88464->88466 88465->88425 88465->88461 88465->88462 88465->88466 88467 6cdd5ed0 104 API calls 88466->88467 88468 6cc67e2f std::ios_base::_Ios_base_dtor _strlen 88467->88468 88468->88406 88469 6cc685bf 88468->88469 88470 6cc685a8 88468->88470 88477 6cc68556 _Yarn _strlen 88468->88477 88471 6cdd6fb3 std::_Facet_Register 4 API calls 88469->88471 88472 6cdd6fb3 std::_Facet_Register 4 API calls 88470->88472 88471->88477 88472->88477 88473 6cc68983 88476 6cdd6fb3 std::_Facet_Register 4 API calls 88473->88476 88474 6cc6896a 88475 6cdd6fb3 std::_Facet_Register 4 API calls 88474->88475 88478 6cc6891d _Yarn 88475->88478 88476->88478 88477->88425 88477->88473 88477->88474 88477->88478 88479 6cdd5ed0 104 API calls 88478->88479 88482 6cc689d0 std::ios_base::_Ios_base_dtor _strlen 88479->88482 88480 6cc68f36 88484 6cdd6fb3 std::_Facet_Register 4 API calls 88480->88484 88481 6cc68f1f 88483 6cdd6fb3 std::_Facet_Register 4 API calls 88481->88483 88482->88406 88482->88480 88482->88481 88485 6cc68ecd _Yarn _strlen 88482->88485 88483->88485 88484->88485 88485->88425 88486 6cc69354 88485->88486 88487 6cc6936d 88485->88487 88490 6cc69307 _Yarn 88485->88490 88488 6cdd6fb3 std::_Facet_Register 4 API calls 88486->88488 88489 6cdd6fb3 std::_Facet_Register 4 API calls 88487->88489 88488->88490 88489->88490 88491 6cdd5ed0 104 API calls 88490->88491 88493 6cc693ba std::ios_base::_Ios_base_dtor 88491->88493 88492 6cdd5560 4 API calls 88492->88419 88493->88406 88493->88492 88494->88427 88496 6cdcb444 88495->88496 88497 6cdcb446 FindFirstFileA 88495->88497 88496->88497 88498 6cdcb480 88497->88498 88499 6cdcb4e2 88498->88499 88500 6cdcb484 FindClose 88498->88500 88499->88415 88500->88498 88502 6cdd563a 88501->88502 88503 6cdd55f0 WaitForSingleObject CloseHandle CloseHandle 88502->88503 88504 6cdd5653 88502->88504 88503->88502 88504->88424 88506 6cdd5f27 88505->88506 88538 6cdd6560 88506->88538 88508 6cdd5f38 88557 6cc76ba0 88508->88557 88511 6cdd600f std::ios_base::_Ios_base_dtor 88514 6cc9e010 67 API calls 88511->88514 88513 6cdd5f5c 88515 6cdd5fc4 88513->88515 88521 6cdd5fd7 88513->88521 88576 6cdd68b0 88513->88576 88584 6ccb2370 88513->88584 88517 6cdd6052 std::ios_base::_Ios_base_dtor 88514->88517 88594 6cdd6100 88515->88594 88517->88445 88519 6cdd5fcc 88615 6cc77090 88519->88615 88609 6cc9e010 88521->88609 88523 6cdd6fb8 88522->88523 88524 6cdd6fd2 88523->88524 88527 6cdd6fd4 std::_Facet_Register 88523->88527 89074 6cddf584 EnterCriticalSection LeaveCriticalSection std::_Facet_Register 88523->89074 88524->88412 88526 6cdd7e33 std::_Facet_Register 89078 6cdd98e9 RaiseException 88526->89078 88527->88526 89075 6cdd98e9 RaiseException 88527->89075 88529 6cdd862c IsProcessorFeaturePresent 88535 6cdd8651 88529->88535 88531 6cdd7df3 89076 6cdd98e9 RaiseException 88531->89076 88533 6cdd7e13 std::invalid_argument::invalid_argument 89077 6cdd98e9 RaiseException 88533->89077 88535->88412 88537->88430 88539 6cdd6595 88538->88539 88628 6cca2020 88539->88628 88541 6cdd6636 88542 6cdd6fb3 std::_Facet_Register 4 API calls 88541->88542 88543 6cdd666e 88542->88543 88645 6cdd7897 88543->88645 88545 6cdd6682 88657 6cca1d90 88545->88657 88548 6cdd675c 88548->88508 88550 6cdd6796 88665 6cca26e0 24 API calls 4 library calls 88550->88665 88552 6cdd67a8 88666 6cdd98e9 RaiseException 88552->88666 88554 6cdd67bd 88555 6cc9e010 67 API calls 88554->88555 88556 6cdd67cf 88555->88556 88556->88508 88558 6cc76bd5 88557->88558 88559 6cca2020 52 API calls 88558->88559 88560 6cc76c68 88559->88560 88561 6cdd6fb3 std::_Facet_Register 4 API calls 88560->88561 88562 6cc76ca0 88561->88562 88563 6cdd7897 43 API calls 88562->88563 88564 6cc76cb4 88563->88564 88565 6cca1d90 89 API calls 88564->88565 88566 6cc76d5d 88565->88566 88567 6cc76d8e 88566->88567 88976 6cca2250 30 API calls 88566->88976 88567->88513 88569 6cc76dc8 88977 6cca26e0 24 API calls 4 library calls 88569->88977 88571 6cc76dda 88978 6cdd98e9 RaiseException 88571->88978 88573 6cc76def 88574 6cc9e010 67 API calls 88573->88574 88575 6cc76e0f 88574->88575 88575->88513 88577 6cdd68fd 88576->88577 88979 6cdd6b10 88577->88979 88579 6cdd69ec 88579->88513 88582 6cdd6915 88582->88579 88997 6cca2250 30 API calls 88582->88997 88998 6cca26e0 24 API calls 4 library calls 88582->88998 88999 6cdd98e9 RaiseException 88582->88999 88585 6ccb23af 88584->88585 88588 6ccb23c3 88585->88588 89008 6cca3560 32 API calls std::_Xinvalid_argument 88585->89008 88590 6ccb247e 88588->88590 89010 6cca2250 30 API calls 88588->89010 89011 6cca26e0 24 API calls 4 library calls 88588->89011 89012 6cdd98e9 RaiseException 88588->89012 88593 6ccb2491 88590->88593 89009 6cca37e0 32 API calls std::_Xinvalid_argument 88590->89009 88593->88513 88595 6cdd610e 88594->88595 88599 6cdd6141 88594->88599 89013 6cca01f0 88595->89013 88597 6cdd61f3 88597->88519 88599->88597 89017 6cca2250 30 API calls 88599->89017 88600 6cde1088 67 API calls 88600->88599 88602 6cdd621e 89018 6cca2340 24 API calls 88602->89018 88604 6cdd622e 89019 6cdd98e9 RaiseException 88604->89019 88606 6cdd6239 88607 6cc9e010 67 API calls 88606->88607 88608 6cdd6292 std::ios_base::_Ios_base_dtor 88607->88608 88608->88519 88610 6cc9e04b 88609->88610 88611 6cc9e0a3 88610->88611 88612 6cca01f0 64 API calls 88610->88612 88611->88511 88613 6cc9e098 88612->88613 88614 6cde1088 67 API calls 88613->88614 88614->88611 88616 6cc7709e 88615->88616 88619 6cc770d1 88615->88619 88618 6cca01f0 64 API calls 88616->88618 88617 6cc77183 88617->88521 88620 6cc770c4 88618->88620 88619->88617 89071 6cca2250 30 API calls 88619->89071 88622 6cde1088 67 API calls 88620->88622 88622->88619 88623 6cc771ae 89072 6cca2340 24 API calls 88623->89072 88625 6cc771be 89073 6cdd98e9 RaiseException 88625->89073 88627 6cc771c9 88629 6cdd6fb3 std::_Facet_Register 4 API calls 88628->88629 88630 6cca207e 88629->88630 88631 6cdd7897 43 API calls 88630->88631 88632 6cca2092 88631->88632 88667 6cca2f60 42 API calls 4 library calls 88632->88667 88634 6cca20c8 88635 6cca210d 88634->88635 88636 6cca2136 88634->88636 88637 6cca2120 88635->88637 88668 6cdd74fe 9 API calls 2 library calls 88635->88668 88669 6cca2250 30 API calls 88636->88669 88637->88541 88640 6cca215b 88670 6cca2340 24 API calls 88640->88670 88642 6cca2171 88671 6cdd98e9 RaiseException 88642->88671 88644 6cca217c 88644->88541 88646 6cdd78a3 __EH_prolog3 88645->88646 88672 6cdd7425 88646->88672 88651 6cdd78c1 88686 6cdd792a 39 API calls std::locale::_Setgloballocale 88651->88686 88652 6cdd791c 88652->88545 88654 6cdd78c9 88687 6cdd7721 HeapFree GetLastError _Yarn ___std_exception_destroy 88654->88687 88656 6cdd78df 88678 6cdd7456 88656->88678 88658 6cca1ddc 88657->88658 88659 6cca1dc7 88657->88659 88692 6cdd79b7 88658->88692 88659->88548 88664 6cca2250 30 API calls 88659->88664 88663 6cca1e82 88664->88550 88665->88552 88666->88554 88667->88634 88668->88637 88669->88640 88670->88642 88671->88644 88673 6cdd743b 88672->88673 88674 6cdd7434 88672->88674 88677 6cdd7439 88673->88677 88689 6cdd8afb EnterCriticalSection 88673->88689 88688 6cde093d 6 API calls std::_Lockit::_Lockit 88674->88688 88677->88656 88685 6cdd77a0 6 API calls 2 library calls 88677->88685 88679 6cde094b 88678->88679 88680 6cdd7460 88678->88680 88691 6cde0926 LeaveCriticalSection 88679->88691 88681 6cdd7473 88680->88681 88690 6cdd8b09 LeaveCriticalSection 88680->88690 88681->88652 88684 6cde0952 88684->88652 88685->88651 88686->88654 88687->88656 88688->88677 88689->88677 88690->88681 88691->88684 88693 6cdd79c0 88692->88693 88694 6cca1dea 88693->88694 88701 6cde02ba 88693->88701 88694->88659 88700 6cddcad3 18 API calls __cftoe 88694->88700 88696 6cdd7a0c 88696->88694 88712 6cddffc8 65 API calls 88696->88712 88698 6cdd7a27 88698->88694 88713 6cde1088 88698->88713 88700->88663 88702 6cde02c5 __wsopen_s 88701->88702 88703 6cde02d8 88702->88703 88704 6cde02f8 88702->88704 88738 6cde0690 18 API calls __cftoe 88703->88738 88706 6cde02e8 88704->88706 88724 6cdeb37c 88704->88724 88706->88696 88712->88698 88714 6cde1094 __wsopen_s 88713->88714 88715 6cde10b3 88714->88715 88716 6cde109e 88714->88716 88722 6cde10ae 88715->88722 88847 6cddcb19 EnterCriticalSection 88715->88847 88862 6cde0690 18 API calls __cftoe 88716->88862 88718 6cde10d0 88848 6cde110c 88718->88848 88721 6cde10db 88863 6cde1102 LeaveCriticalSection 88721->88863 88722->88694 88725 6cdeb388 __wsopen_s 88724->88725 88740 6cde090f EnterCriticalSection 88725->88740 88727 6cdeb396 88741 6cdeb420 88727->88741 88732 6cdeb4e2 88733 6cdeb601 88732->88733 88765 6cdeb684 88733->88765 88736 6cde033c 88739 6cde0365 LeaveCriticalSection 88736->88739 88738->88706 88739->88706 88740->88727 88742 6cdeb443 88741->88742 88743 6cdeb49b 88742->88743 88750 6cdeb3a3 88742->88750 88758 6cddcb19 EnterCriticalSection 88742->88758 88759 6cddcb2d LeaveCriticalSection 88742->88759 88760 6cde7755 EnterCriticalSection LeaveCriticalSection HeapAlloc __Getctype std::_Facet_Register 88743->88760 88745 6cdeb4a4 88761 6cde4d2b HeapFree GetLastError _free 88745->88761 88748 6cdeb4ad 88748->88750 88762 6cde718f 6 API calls std::_Lockit::_Lockit 88748->88762 88755 6cdeb3dc 88750->88755 88751 6cdeb4cc 88763 6cddcb19 EnterCriticalSection 88751->88763 88754 6cdeb4df 88754->88750 88764 6cde0926 LeaveCriticalSection 88755->88764 88757 6cde0313 88757->88706 88757->88732 88758->88742 88759->88742 88760->88745 88761->88748 88762->88751 88763->88754 88764->88757 88767 6cdeb6a3 88765->88767 88766 6cdeb6cb 88774 6cdeb7eb 88766->88774 88782 6cdf4418 37 API calls __cftoe 88766->88782 88767->88766 88768 6cdeb6b6 88767->88768 88781 6cde0690 18 API calls __cftoe 88768->88781 88770 6cdeb617 88770->88736 88778 6cdf454e 88770->88778 88773 6cdeb83b 88773->88774 88783 6cdf4418 37 API calls __cftoe 88773->88783 88774->88770 88785 6cde0690 18 API calls __cftoe 88774->88785 88776 6cdeb859 88776->88774 88784 6cdf4418 37 API calls __cftoe 88776->88784 88786 6cdf4906 88778->88786 88781->88770 88782->88773 88783->88776 88784->88774 88785->88770 88788 6cdf4912 __wsopen_s 88786->88788 88787 6cdf4919 88804 6cde0690 18 API calls __cftoe 88787->88804 88788->88787 88789 6cdf4944 88788->88789 88795 6cdf456e 88789->88795 88794 6cdf4569 88794->88736 88806 6cde0c3b 88795->88806 88800 6cdf45a4 88802 6cdf45d6 88800->88802 88846 6cde4d2b HeapFree GetLastError _free 88800->88846 88805 6cdf499b LeaveCriticalSection __wsopen_s 88802->88805 88804->88794 88805->88794 88807 6cddc25b __fassign 37 API calls 88806->88807 88808 6cde0c4d 88807->88808 88809 6cde0c5f 88808->88809 88810 6cde6f45 __wsopen_s 5 API calls 88808->88810 88811 6cddc366 88809->88811 88810->88809 88812 6cddc3be __wsopen_s GetLastError HeapFree GetLastError MultiByteToWideChar 88811->88812 88813 6cddc37e 88812->88813 88813->88800 88814 6cdf45dc 88813->88814 88815 6cdf4a5c __wsopen_s 18 API calls 88814->88815 88816 6cdf45f9 88815->88816 88817 6cdf1b7c __wsopen_s 14 API calls 88816->88817 88821 6cdf460e __dosmaperr 88816->88821 88818 6cdf462c 88817->88818 88819 6cdf49c7 __wsopen_s CreateFileW 88818->88819 88818->88821 88826 6cdf4685 88819->88826 88820 6cdf4702 GetFileType 88822 6cdf470d GetLastError 88820->88822 88823 6cdf4754 88820->88823 88821->88800 88825 6cddff62 __dosmaperr 88822->88825 88829 6cdf1d20 __wsopen_s SetStdHandle 88823->88829 88824 6cdf46d7 GetLastError 88824->88821 88827 6cdf471b CloseHandle 88825->88827 88826->88820 88826->88824 88828 6cdf49c7 __wsopen_s CreateFileW 88826->88828 88827->88821 88842 6cdf4744 88827->88842 88830 6cdf46ca 88828->88830 88831 6cdf4775 88829->88831 88830->88820 88830->88824 88832 6cdf47c1 88831->88832 88834 6cdf4bd6 __wsopen_s 70 API calls 88831->88834 88833 6cdf4c80 __wsopen_s 70 API calls 88832->88833 88836 6cdf47c8 88832->88836 88835 6cdf47f6 88833->88835 88834->88832 88835->88836 88837 6cdf4804 88835->88837 88838 6cdebe95 __wsopen_s 21 API calls 88836->88838 88837->88821 88839 6cdf4880 CloseHandle 88837->88839 88838->88821 88840 6cdf49c7 __wsopen_s CreateFileW 88839->88840 88841 6cdf48ab 88840->88841 88841->88842 88843 6cdf48b5 GetLastError 88841->88843 88842->88821 88844 6cdf48c1 __dosmaperr 88843->88844 88845 6cdf1c8f __wsopen_s SetStdHandle 88844->88845 88845->88842 88846->88802 88847->88718 88849 6cde112e 88848->88849 88850 6cde1119 88848->88850 88853 6cde1129 88849->88853 88864 6cde1229 88849->88864 88886 6cde0690 18 API calls __cftoe 88850->88886 88853->88721 88858 6cde1151 88879 6cdebe08 88858->88879 88860 6cde1157 88860->88853 88887 6cde4d2b HeapFree GetLastError _free 88860->88887 88862->88722 88863->88722 88865 6cde1143 88864->88865 88866 6cde1241 88864->88866 88870 6cde8cae 88865->88870 88866->88865 88867 6cdea1d0 18 API calls 88866->88867 88868 6cde125f 88867->88868 88888 6cdec0dc 88868->88888 88871 6cde114b 88870->88871 88872 6cde8cc5 88870->88872 88874 6cdea1d0 88871->88874 88872->88871 88944 6cde4d2b HeapFree GetLastError _free 88872->88944 88875 6cdea1dc 88874->88875 88876 6cdea1f1 88874->88876 88945 6cde0690 18 API calls __cftoe 88875->88945 88876->88858 88878 6cdea1ec 88878->88858 88880 6cdebe2e 88879->88880 88881 6cdebe19 __dosmaperr 88879->88881 88882 6cdebe55 88880->88882 88883 6cdebe77 __dosmaperr 88880->88883 88881->88860 88946 6cdebf31 88882->88946 88954 6cde0690 18 API calls __cftoe 88883->88954 88886->88853 88887->88853 88889 6cdec0e8 __wsopen_s 88888->88889 88890 6cdec0f0 __dosmaperr 88889->88890 88891 6cdec13a 88889->88891 88892 6cdec1a3 __dosmaperr 88889->88892 88890->88865 88899 6cdf1f00 EnterCriticalSection 88891->88899 88929 6cde0690 18 API calls __cftoe 88892->88929 88894 6cdec140 88897 6cdec15c __dosmaperr 88894->88897 88900 6cdec1ce 88894->88900 88928 6cdec19b LeaveCriticalSection __wsopen_s 88897->88928 88899->88894 88901 6cdec1f0 88900->88901 88927 6cdec20c __dosmaperr 88900->88927 88902 6cdec244 88901->88902 88903 6cdec1f4 __dosmaperr 88901->88903 88904 6cdec257 88902->88904 88938 6cdeb1d9 20 API calls __wsopen_s 88902->88938 88937 6cde0690 18 API calls __cftoe 88903->88937 88930 6cdec3b0 88904->88930 88909 6cdec2ac 88913 6cdec305 WriteFile 88909->88913 88914 6cdec2c0 88909->88914 88910 6cdec26d 88911 6cdec296 88910->88911 88912 6cdec271 88910->88912 88940 6cdec421 43 API calls 5 library calls 88911->88940 88912->88927 88939 6cdec7cb 6 API calls __wsopen_s 88912->88939 88918 6cdec329 GetLastError 88913->88918 88913->88927 88915 6cdec2cb 88914->88915 88916 6cdec2f5 88914->88916 88919 6cdec2e5 88915->88919 88920 6cdec2d0 88915->88920 88943 6cdec833 7 API calls 2 library calls 88916->88943 88918->88927 88942 6cdec9f7 8 API calls 3 library calls 88919->88942 88923 6cdec2d5 88920->88923 88920->88927 88941 6cdec90e 7 API calls 2 library calls 88923->88941 88925 6cdec2e3 88925->88927 88927->88897 88928->88890 88929->88890 88931 6cdf1f55 __wsopen_s 18 API calls 88930->88931 88932 6cdec3c1 88931->88932 88933 6cdec268 88932->88933 88934 6cde4f22 __Getctype 37 API calls 88932->88934 88933->88909 88933->88910 88935 6cdec3e4 88934->88935 88935->88933 88936 6cdec3fe GetConsoleMode 88935->88936 88936->88933 88937->88927 88938->88904 88939->88927 88940->88927 88941->88925 88942->88925 88943->88925 88944->88871 88945->88878 88947 6cdebf3d __wsopen_s 88946->88947 88955 6cdf1f00 EnterCriticalSection 88947->88955 88949 6cdebf4b 88951 6cdebf78 88949->88951 88956 6cdebe95 88949->88956 88969 6cdebfb1 LeaveCriticalSection __wsopen_s 88951->88969 88953 6cdebf9a 88953->88881 88954->88881 88955->88949 88970 6cdf1b12 88956->88970 88958 6cdebeab 88975 6cdf1c8f SetStdHandle __dosmaperr __wsopen_s 88958->88975 88960 6cdebea5 88960->88958 88961 6cdebedd 88960->88961 88962 6cdf1b12 __wsopen_s 18 API calls 88960->88962 88961->88958 88963 6cdf1b12 __wsopen_s 18 API calls 88961->88963 88964 6cdebed4 88962->88964 88965 6cdebee9 CloseHandle 88963->88965 88966 6cdf1b12 __wsopen_s 18 API calls 88964->88966 88965->88958 88967 6cdebef5 GetLastError 88965->88967 88966->88961 88967->88958 88968 6cdebf03 __dosmaperr 88968->88951 88969->88953 88971 6cdf1b34 __dosmaperr 88970->88971 88972 6cdf1b1f __dosmaperr 88970->88972 88973 6cdf1b59 88971->88973 88974 6cde0690 __cftoe 18 API calls 88971->88974 88972->88960 88973->88960 88974->88972 88975->88968 88976->88569 88977->88571 88978->88573 88980 6cdd6b4c 88979->88980 88981 6cdd6b78 88979->88981 88982 6cdd6b71 88980->88982 89002 6cca2250 30 API calls 88980->89002 88987 6cdd6b89 88981->88987 89000 6cca3560 32 API calls std::_Xinvalid_argument 88981->89000 88982->88582 88985 6cdd6d58 89003 6cca2340 24 API calls 88985->89003 88987->88982 89001 6cca2f60 42 API calls 4 library calls 88987->89001 88988 6cdd6d67 89004 6cdd98e9 RaiseException 88988->89004 88992 6cdd6d97 89006 6cca2340 24 API calls 88992->89006 88994 6cdd6dad 89007 6cdd98e9 RaiseException 88994->89007 88996 6cdd6bc3 88996->88982 89005 6cca2250 30 API calls 88996->89005 88997->88582 88998->88582 88999->88582 89000->88987 89001->88996 89002->88985 89003->88988 89004->88996 89005->88992 89006->88994 89007->88982 89008->88588 89009->88593 89010->88588 89011->88588 89012->88588 89014 6cca022e 89013->89014 89015 6cca04d6 89014->89015 89020 6cde1d4b 89014->89020 89015->88600 89017->88602 89018->88604 89019->88606 89021 6cde1d59 89020->89021 89022 6cde1d76 89020->89022 89021->89022 89023 6cde1d7a 89021->89023 89024 6cde1d66 89021->89024 89022->89014 89028 6cde1f72 89023->89028 89036 6cde0690 18 API calls __cftoe 89024->89036 89029 6cde1f7e __wsopen_s 89028->89029 89037 6cddcb19 EnterCriticalSection 89029->89037 89031 6cde1f8c 89038 6cde1f2f 89031->89038 89035 6cde1dac 89035->89014 89036->89022 89037->89031 89046 6cde8b16 89038->89046 89044 6cde1f69 89045 6cde1fc1 LeaveCriticalSection 89044->89045 89045->89035 89047 6cdea1d0 18 API calls 89046->89047 89048 6cde8b27 89047->89048 89063 6cdf1f55 89048->89063 89050 6cde1f43 89053 6cde1dae 89050->89053 89051 6cde8b2d __wsopen_s 89051->89050 89068 6cde4d2b HeapFree GetLastError _free 89051->89068 89055 6cde1dc0 89053->89055 89057 6cde1dde 89053->89057 89054 6cde1dce 89070 6cde0690 18 API calls __cftoe 89054->89070 89055->89054 89055->89057 89060 6cde1df6 _Yarn 89055->89060 89062 6cde8bc9 62 API calls 89057->89062 89058 6cde1229 62 API calls 89058->89060 89059 6cdea1d0 18 API calls 89059->89060 89060->89057 89060->89058 89060->89059 89061 6cdec0dc __wsopen_s 62 API calls 89060->89061 89061->89060 89062->89044 89064 6cdf1f62 89063->89064 89066 6cdf1f6f 89063->89066 89064->89051 89065 6cdf1f7b 89065->89051 89066->89065 89069 6cde0690 18 API calls __cftoe 89066->89069 89068->89050 89069->89064 89070->89057 89071->88623 89072->88625 89073->88627 89074->88523 89075->88531 89076->88533 89077->88526 89078->88529 89079 6cddf4af 89080 6cddf4bb __wsopen_s 89079->89080 89081 6cddf4cf 89080->89081 89082 6cddf4c2 GetLastError ExitThread 89080->89082 89091 6cde4f22 GetLastError 89081->89091 89087 6cddf4eb 89124 6cddf41a 16 API calls 2 library calls 89087->89124 89090 6cddf50d 89092 6cde4f39 89091->89092 89093 6cde4f3f 89091->89093 89125 6cde7093 6 API calls std::_Lockit::_Lockit 89092->89125 89097 6cde4f45 SetLastError 89093->89097 89126 6cde70d2 6 API calls std::_Lockit::_Lockit 89093->89126 89096 6cde4f5d 89096->89097 89098 6cde4f61 89096->89098 89104 6cde4fd9 89097->89104 89105 6cddf4d4 89097->89105 89127 6cde7755 EnterCriticalSection LeaveCriticalSection HeapAlloc __Getctype std::_Facet_Register 89098->89127 89100 6cde4f6d 89102 6cde4f8c 89100->89102 89103 6cde4f75 89100->89103 89130 6cde70d2 6 API calls std::_Lockit::_Lockit 89102->89130 89128 6cde70d2 6 API calls std::_Lockit::_Lockit 89103->89128 89133 6cde1039 37 API calls std::locale::_Setgloballocale 89104->89133 89118 6cdea2d6 89105->89118 89109 6cde4f83 89129 6cde4d2b HeapFree GetLastError _free 89109->89129 89111 6cde4f98 89112 6cde4f9c 89111->89112 89113 6cde4fad 89111->89113 89131 6cde70d2 6 API calls std::_Lockit::_Lockit 89112->89131 89132 6cde4d2b HeapFree GetLastError _free 89113->89132 89116 6cde4f89 89116->89097 89119 6cdea2e8 GetPEB 89118->89119 89120 6cddf4df 89118->89120 89119->89120 89121 6cdea2fb 89119->89121 89120->89087 89123 6cde72df 5 API calls std::_Lockit::_Lockit 89120->89123 89134 6cde7388 5 API calls std::_Lockit::_Lockit 89121->89134 89123->89087 89124->89090 89125->89093 89126->89096 89127->89100 89128->89109 89129->89116 89130->89111 89131->89109 89132->89116 89134->89120 89135 6cc54b53 89136 6cdd6fb3 std::_Facet_Register 4 API calls 89135->89136 89137 6cc54b5c _Yarn 89136->89137 89138 6cdcb430 2 API calls 89137->89138 89143 6cc54bae std::ios_base::_Ios_base_dtor 89138->89143 89139 6cc7639e 89326 6cde06a0 18 API calls 2 library calls 89139->89326 89141 6cc54cff 89142 6cc55164 CreateFileA CloseHandle 89147 6cc551ec 89142->89147 89143->89139 89143->89141 89143->89142 89144 6cc6245a _Yarn _strlen 89143->89144 89144->89139 89145 6cdcb430 2 API calls 89144->89145 89162 6cc62a83 std::ios_base::_Ios_base_dtor 89145->89162 89293 6cdd5690 OpenSCManagerA 89147->89293 89149 6cc5fc00 89319 6cdd57b0 CreateToolhelp32Snapshot 89149->89319 89151 6cdd6fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 89189 6cc55478 std::ios_base::_Ios_base_dtor _Yarn _strlen 89151->89189 89154 6cdcb430 2 API calls 89154->89189 89155 6cc637d0 Sleep 89199 6cc637e0 std::ios_base::_Ios_base_dtor _Yarn _strlen 89155->89199 89156 6cc763b2 89327 6cc515e0 18 API calls std::ios_base::_Ios_base_dtor 89156->89327 89157 6cdd57b0 4 API calls 89174 6cc6053a 89157->89174 89159 6cdd57b0 4 API calls 89184 6cc612e2 89159->89184 89160 6cc5ffe3 89160->89157 89166 6cc60abc 89160->89166 89161 6cc764f8 89162->89139 89297 6cdc0900 89162->89297 89163 6cc76ba0 104 API calls 89163->89189 89164 6cc76e60 32 API calls 89164->89189 89166->89144 89166->89159 89167 6cc77090 77 API calls 89167->89189 89168 6cdd57b0 4 API calls 89168->89166 89169 6cdd57b0 4 API calls 89187 6cc61dd9 89169->89187 89170 6cc6211c 89170->89144 89172 6cc6241a 89170->89172 89171 6cc9e010 67 API calls 89171->89189 89175 6cdc0900 11 API calls 89172->89175 89173 6cdcb430 2 API calls 89173->89199 89174->89166 89174->89168 89177 6cc6244d 89175->89177 89176 6cc56722 89316 6cdd1df0 25 API calls 4 library calls 89176->89316 89325 6cdd62d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 89177->89325 89179 6cc62452 Sleep 89179->89144 89180 6cc56162 89181 6cc616ac 89182 6cdd5560 4 API calls 89192 6cc5775a _strlen 89182->89192 89183 6cc5740b 89183->89182 89184->89169 89184->89170 89184->89181 89185 6cdd57b0 4 API calls 89185->89170 89186 6cc76ba0 104 API calls 89186->89199 89187->89170 89187->89185 89189->89139 89189->89149 89189->89151 89189->89154 89189->89163 89189->89164 89189->89167 89189->89171 89189->89176 89189->89180 89190 6cc77090 77 API calls 89190->89199 89191 6cc9e010 67 API calls 89191->89199 89192->89139 89193 6cc57b92 89192->89193 89194 6cc57ba9 89192->89194 89197 6cc57b43 _Yarn 89192->89197 89195 6cdd6fb3 std::_Facet_Register 4 API calls 89193->89195 89196 6cdd6fb3 std::_Facet_Register 4 API calls 89194->89196 89195->89197 89196->89197 89198 6cdcb430 2 API calls 89197->89198 89207 6cc57be7 std::ios_base::_Ios_base_dtor 89198->89207 89199->89139 89199->89173 89199->89186 89199->89190 89199->89191 89306 6cc76e60 89199->89306 89200 6cdd5560 4 API calls 89211 6cc58a07 89200->89211 89201 6cc59d7f 89204 6cdd6fb3 std::_Facet_Register 4 API calls 89201->89204 89202 6cc59d68 89203 6cdd6fb3 std::_Facet_Register 4 API calls 89202->89203 89205 6cc59d18 _Yarn 89203->89205 89204->89205 89206 6cdcb430 2 API calls 89205->89206 89214 6cc59dbd std::ios_base::_Ios_base_dtor 89206->89214 89207->89139 89207->89200 89208 6cc5962c _strlen 89207->89208 89209 6cc58387 89207->89209 89208->89139 89208->89201 89208->89202 89208->89205 89210 6cdd5560 4 API calls 89221 6cc59120 89210->89221 89211->89210 89212 6cdd5560 4 API calls 89229 6cc5a215 _strlen 89212->89229 89213 6cdd5560 4 API calls 89215 6cc59624 89213->89215 89214->89139 89214->89212 89222 6cc5e8b5 std::ios_base::_Ios_base_dtor _Yarn _strlen 89214->89222 89317 6cdd62d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 89215->89317 89216 6cdd6fb3 IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection std::_Facet_Register 89216->89222 89218 6cdcb430 2 API calls 89218->89222 89219 6cc5f7b1 89318 6cdd62d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 89219->89318 89220 6cc5ed02 Sleep 89241 6cc5e8c1 89220->89241 89221->89213 89222->89139 89222->89216 89222->89218 89222->89219 89222->89220 89224 6cc5e8dd GetCurrentProcess TerminateProcess 89224->89222 89225 6cc5a9a4 89227 6cdd6fb3 std::_Facet_Register 4 API calls 89225->89227 89226 6cc5a9bb 89228 6cdd6fb3 std::_Facet_Register 4 API calls 89226->89228 89238 6cc5a953 _Yarn _strlen 89227->89238 89228->89238 89229->89139 89229->89225 89229->89226 89229->89238 89230 6cdd5560 4 API calls 89230->89241 89231 6cc5fbb8 89233 6cc5fbe8 ExitWindowsEx Sleep 89231->89233 89232 6cc5f7c0 89232->89231 89233->89149 89234 6cc5aff0 89236 6cdd6fb3 std::_Facet_Register 4 API calls 89234->89236 89235 6cc5b009 89237 6cdd6fb3 std::_Facet_Register 4 API calls 89235->89237 89239 6cc5afa0 _Yarn 89236->89239 89237->89239 89238->89156 89238->89234 89238->89235 89238->89239 89240 6cdd5ed0 104 API calls 89239->89240 89242 6cc5b059 std::ios_base::_Ios_base_dtor _strlen 89240->89242 89241->89222 89241->89224 89241->89230 89242->89139 89243 6cc5b443 89242->89243 89244 6cc5b42c 89242->89244 89247 6cc5b3da _Yarn _strlen 89242->89247 89245 6cdd6fb3 std::_Facet_Register 4 API calls 89243->89245 89246 6cdd6fb3 std::_Facet_Register 4 API calls 89244->89246 89245->89247 89246->89247 89247->89156 89248 6cc5b7b7 89247->89248 89249 6cc5b79e 89247->89249 89252 6cc5b751 _Yarn 89247->89252 89251 6cdd6fb3 std::_Facet_Register 4 API calls 89248->89251 89250 6cdd6fb3 std::_Facet_Register 4 API calls 89249->89250 89250->89252 89251->89252 89253 6cdd5ed0 104 API calls 89252->89253 89254 6cc5b804 std::ios_base::_Ios_base_dtor _strlen 89253->89254 89254->89139 89255 6cc5bc26 89254->89255 89256 6cc5bc0f 89254->89256 89259 6cc5bbbd _Yarn _strlen 89254->89259 89258 6cdd6fb3 std::_Facet_Register 4 API calls 89255->89258 89257 6cdd6fb3 std::_Facet_Register 4 API calls 89256->89257 89257->89259 89258->89259 89259->89156 89260 6cc5c075 89259->89260 89261 6cc5c08e 89259->89261 89264 6cc5c028 _Yarn 89259->89264 89262 6cdd6fb3 std::_Facet_Register 4 API calls 89260->89262 89263 6cdd6fb3 std::_Facet_Register 4 API calls 89261->89263 89262->89264 89263->89264 89265 6cdd5ed0 104 API calls 89264->89265 89270 6cc5c0db std::ios_base::_Ios_base_dtor _strlen 89265->89270 89266 6cc5c7a5 89269 6cdd6fb3 std::_Facet_Register 4 API calls 89266->89269 89267 6cc5c7bc 89268 6cdd6fb3 std::_Facet_Register 4 API calls 89267->89268 89277 6cc5c753 _Yarn _strlen 89268->89277 89269->89277 89270->89139 89270->89266 89270->89267 89270->89277 89271 6cc5d406 89274 6cdd6fb3 std::_Facet_Register 4 API calls 89271->89274 89272 6cc5d3ed 89273 6cdd6fb3 std::_Facet_Register 4 API calls 89272->89273 89275 6cc5d39a _Yarn 89273->89275 89274->89275 89276 6cdd5ed0 104 API calls 89275->89276 89278 6cc5d458 std::ios_base::_Ios_base_dtor _strlen 89276->89278 89277->89156 89277->89271 89277->89272 89277->89275 89283 6cc5cb2f 89277->89283 89278->89139 89279 6cc5d8a4 89278->89279 89280 6cc5d8bb 89278->89280 89284 6cc5d852 _Yarn _strlen 89278->89284 89281 6cdd6fb3 std::_Facet_Register 4 API calls 89279->89281 89282 6cdd6fb3 std::_Facet_Register 4 API calls 89280->89282 89281->89284 89282->89284 89284->89156 89285 6cc5dcb6 89284->89285 89286 6cc5dccf 89284->89286 89289 6cc5dc69 _Yarn 89284->89289 89287 6cdd6fb3 std::_Facet_Register 4 API calls 89285->89287 89288 6cdd6fb3 std::_Facet_Register 4 API calls 89286->89288 89287->89289 89288->89289 89290 6cdd5ed0 104 API calls 89289->89290 89292 6cc5dd1c std::ios_base::_Ios_base_dtor 89290->89292 89291 6cdd5560 4 API calls 89291->89222 89292->89139 89292->89291 89295 6cdd56c6 89293->89295 89294 6cdd5758 OpenServiceA 89294->89295 89295->89294 89296 6cdd579f 89295->89296 89296->89189 89299 6cdc0913 _Yarn __wsopen_s std::locale::_Setgloballocale _strlen 89297->89299 89298 6cdc44cf CloseHandle 89298->89299 89299->89298 89300 6cdc367e CloseHandle 89299->89300 89301 6cc637cb 89299->89301 89302 6cdac750 WriteFile WriteFile WriteFile ReadFile 89299->89302 89303 6cdc2a8b CloseHandle 89299->89303 89328 6cdabca0 89299->89328 89300->89299 89305 6cdd62d0 GetCurrentProcess OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges NtInitiatePowerAction 89301->89305 89302->89299 89303->89299 89305->89155 89307 6cc76e9f 89306->89307 89310 6cc76eb3 89307->89310 89339 6cca3560 32 API calls std::_Xinvalid_argument 89307->89339 89312 6cc76f5b 89310->89312 89341 6cca2250 30 API calls 89310->89341 89342 6cca26e0 24 API calls 4 library calls 89310->89342 89343 6cdd98e9 RaiseException 89310->89343 89313 6cc76f6e 89312->89313 89340 6cca37e0 32 API calls std::_Xinvalid_argument 89312->89340 89313->89199 89316->89183 89317->89208 89318->89232 89320 6cdd5810 std::locale::_Setgloballocale 89319->89320 89321 6cdd57e7 CloseHandle 89320->89321 89322 6cdd5890 Process32NextW 89320->89322 89323 6cdd5921 89320->89323 89324 6cdd58b5 Process32FirstW 89320->89324 89321->89320 89322->89320 89323->89160 89324->89320 89325->89179 89327->89161 89329 6cdabcb3 _Yarn __wsopen_s std::locale::_Setgloballocale 89328->89329 89330 6cdac6f0 89329->89330 89331 6cdac25d CreateFileA 89329->89331 89333 6cdaafa0 89329->89333 89330->89299 89331->89329 89334 6cdaafb3 __wsopen_s std::locale::_Setgloballocale 89333->89334 89335 6cdab959 WriteFile 89334->89335 89336 6cdab9ad WriteFile 89334->89336 89337 6cdabc88 89334->89337 89338 6cdab105 ReadFile 89334->89338 89335->89334 89336->89334 89337->89329 89338->89334 89339->89310 89340->89313 89341->89310 89342->89310 89343->89310 89344 6cc53d62 89346 6cc53bc0 89344->89346 89345 6cc53e8a GetCurrentThread NtSetInformationThread 89347 6cc53eea 89345->89347 89346->89345 89348 6cded043 89349 6cded055 __dosmaperr 89348->89349 89350 6cded06d 89348->89350 89350->89349 89351 6cded0e7 89350->89351 89353 6cded0b8 __dosmaperr 89350->89353 89354 6cded100 89351->89354 89355 6cded157 __wsopen_s 89351->89355 89356 6cded11b __dosmaperr 89351->89356 89390 6cde0690 18 API calls __cftoe 89353->89390 89354->89356 89376 6cded105 89354->89376 89384 6cde4d2b HeapFree GetLastError _free 89355->89384 89383 6cde0690 18 API calls __cftoe 89356->89383 89357 6cdf1f55 __wsopen_s 18 API calls 89358 6cded2ae 89357->89358 89360 6cded324 89358->89360 89364 6cded2c7 GetConsoleMode 89358->89364 89366 6cded328 ReadFile 89360->89366 89361 6cded177 89385 6cde4d2b HeapFree GetLastError _free 89361->89385 89363 6cded132 __dosmaperr __wsopen_s 89387 6cde4d2b HeapFree GetLastError _free 89363->89387 89364->89360 89369 6cded2d8 89364->89369 89367 6cded39c GetLastError 89366->89367 89368 6cded342 89366->89368 89367->89363 89368->89367 89371 6cded319 89368->89371 89369->89366 89372 6cded2de ReadConsoleW 89369->89372 89370 6cded17e 89370->89363 89386 6cdeb1d9 20 API calls __wsopen_s 89370->89386 89371->89363 89377 6cded37e 89371->89377 89378 6cded367 89371->89378 89372->89371 89374 6cded2fa GetLastError 89372->89374 89374->89363 89376->89357 89377->89363 89380 6cded395 89377->89380 89388 6cded46e 23 API calls 3 library calls 89378->89388 89389 6cded726 21 API calls __wsopen_s 89380->89389 89382 6cded39a 89382->89363 89383->89363 89384->89361 89385->89370 89386->89376 89387->89349 89388->89363 89389->89382 89390->89349

                              Executed Functions

                              Function 6CC54754 Relevance: 69.2, APIs: 28, Strings: 1, Instructions: 18471COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: _strlen
                              • String ID: HR^
                              • API String ID: 4218353326-1341859651
                              • Opcode ID: c684a111503b99fd11b251d004c2eeefdde4e4b2d564da30de0d721dd6a29049
                              • Instruction ID: 2348308b08bd29923ca6be26b0a51af5e2e3dd1f334ae082b0d8bf489daf1f50
                              • Opcode Fuzzy Hash: c684a111503b99fd11b251d004c2eeefdde4e4b2d564da30de0d721dd6a29049
                              • Instruction Fuzzy Hash: 92742571644B028FC728CF29C8D0A95B7E3FF85318B598A6DC0A68BB55F734B45ACB50
                              Function 6CC64A27 Relevance: 61.3, APIs: 25, Strings: 3, Instructions: 12265COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: }jk$;T55$L@^
                              • API String ID: 0-4218709813
                              • Opcode ID: 387935cf325d565dee998d03fdd4ca22542ce8e9d34d692610266446a6c2fe8e
                              • Instruction ID: 1eb73352541f320515824fac5eb8beb4479134e1087b3e381e57eac12b1adc04
                              • Opcode Fuzzy Hash: 387935cf325d565dee998d03fdd4ca22542ce8e9d34d692610266446a6c2fe8e
                              • Instruction Fuzzy Hash: 81340671644B018FC728CF2AC9D0A95B7E3FF85318B198A6DC0A68BF55E734B54ACB50
                              Function 6CDD57B0 Relevance: 6.1, APIs: 4, Instructions: 95processCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7677 6cdd57b0-6cdd57e5 CreateToolhelp32Snapshot 7678 6cdd5810-6cdd5819 7677->7678 7679 6cdd581b-6cdd5820 7678->7679 7680 6cdd5850-6cdd5855 7678->7680 7681 6cdd5885-6cdd588a 7679->7681 7682 6cdd5822-6cdd5827 7679->7682 7683 6cdd585b-6cdd5860 7680->7683 7684 6cdd58e7-6cdd5911 call 6cde3175 7680->7684 7690 6cdd5916-6cdd591b 7681->7690 7691 6cdd5890-6cdd58a2 Process32NextW 7681->7691 7686 6cdd5829-6cdd582e 7682->7686 7687 6cdd58a4-6cdd58cd call 6cddbe90 Process32FirstW 7682->7687 7688 6cdd57e7-6cdd5802 CloseHandle 7683->7688 7689 6cdd5862-6cdd5867 7683->7689 7684->7678 7686->7678 7694 6cdd5830-6cdd5841 7686->7694 7696 6cdd58d2-6cdd58e2 7687->7696 7688->7678 7689->7678 7695 6cdd5869-6cdd5883 7689->7695 7690->7678 7693 6cdd5921-6cdd592f 7690->7693 7691->7696 7694->7678 7695->7678 7696->7678
                              APIs
                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 6CDD57BE
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CreateSnapshotToolhelp32
                              • String ID:
                              • API String ID: 3332741929-0
                              • Opcode ID: 855a0886dd9f7fd734f8d37023983536c7bb6c1f64b5c87c28d0d05ad04e9dd5
                              • Instruction ID: 5b275ca551263b9a6bdedd784b7c59bf99683ec5740bc1f2c744436b00b3e595
                              • Opcode Fuzzy Hash: 855a0886dd9f7fd734f8d37023983536c7bb6c1f64b5c87c28d0d05ad04e9dd5
                              • Instruction Fuzzy Hash: 43314CB5A08340EBD7109F28D884B0AFBF4EF95745F51492EE498D7770E771A8888B52
                              Function 6CC53886 Relevance: 3.6, APIs: 2, Instructions: 573COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7821 6cc53886-6cc5388e 7822 6cc53894-6cc53896 7821->7822 7823 6cc53970-6cc5397d 7821->7823 7822->7823 7826 6cc5389c-6cc538b9 7822->7826 7824 6cc539f1-6cc539f8 7823->7824 7825 6cc5397f-6cc53989 7823->7825 7828 6cc53ab5-6cc53aba 7824->7828 7829 6cc539fe-6cc53a03 7824->7829 7825->7826 7827 6cc5398f-6cc53994 7825->7827 7830 6cc538c0-6cc538c1 7826->7830 7831 6cc53b16-6cc53b18 7827->7831 7832 6cc5399a-6cc5399f 7827->7832 7828->7826 7836 6cc53ac0-6cc53ac7 7828->7836 7833 6cc538d2-6cc538d4 7829->7833 7834 6cc53a09-6cc53a2f 7829->7834 7835 6cc5395e 7830->7835 7831->7830 7837 6cc539a5-6cc539bf 7832->7837 7838 6cc5383b-6cc53855 call 6cda19e0 call 6cda19f0 7832->7838 7841 6cc53957-6cc5395c 7833->7841 7839 6cc53a35-6cc53a3a 7834->7839 7840 6cc538f8-6cc53955 7834->7840 7842 6cc53960-6cc53964 7835->7842 7836->7830 7843 6cc53acd-6cc53ad6 7836->7843 7845 6cc53a5a-6cc53a5d 7837->7845 7849 6cc53860-6cc53885 7838->7849 7846 6cc53a40-6cc53a57 7839->7846 7847 6cc53b1d-6cc53b22 7839->7847 7840->7841 7841->7835 7842->7849 7850 6cc5396a 7842->7850 7843->7831 7844 6cc53ad8-6cc53aeb 7843->7844 7844->7840 7852 6cc53af1-6cc53af8 7844->7852 7856 6cc53aa9-6cc53ab0 7845->7856 7846->7845 7854 6cc53b24-6cc53b44 7847->7854 7855 6cc53b49-6cc53b50 7847->7855 7849->7821 7851 6cc53ba1-6cc53bb6 7850->7851 7864 6cc53bc0-6cc53bda call 6cda19e0 call 6cda19f0 7851->7864 7859 6cc53b62-6cc53b85 7852->7859 7860 6cc53afa-6cc53aff 7852->7860 7854->7856 7855->7830 7863 6cc53b56-6cc53b5d 7855->7863 7856->7842 7859->7840 7867 6cc53b8b 7859->7867 7860->7841 7863->7842 7872 6cc53be0-6cc53bfe 7864->7872 7867->7851 7875 6cc53c04-6cc53c11 7872->7875 7876 6cc53e7b 7872->7876 7877 6cc53c17-6cc53c20 7875->7877 7878 6cc53ce0-6cc53cea 7875->7878 7879 6cc53e81-6cc53ee0 call 6cc53750 GetCurrentThread NtSetInformationThread 7876->7879 7880 6cc53dc5 7877->7880 7881 6cc53c26-6cc53c2d 7877->7881 7882 6cc53cec-6cc53d0c 7878->7882 7883 6cc53d3a-6cc53d3c 7878->7883 7892 6cc53eea-6cc53f04 call 6cda19e0 call 6cda19f0 7879->7892 7886 6cc53dc6 7880->7886 7887 6cc53dc3 7881->7887 7888 6cc53c33-6cc53c3a 7881->7888 7889 6cc53d90-6cc53d95 7882->7889 7890 6cc53d70-6cc53d8d 7883->7890 7891 6cc53d3e-6cc53d45 7883->7891 7897 6cc53dc8-6cc53dcc 7886->7897 7887->7880 7895 6cc53e26-6cc53e2b 7888->7895 7896 6cc53c40-6cc53c5b 7888->7896 7893 6cc53d97-6cc53db8 7889->7893 7894 6cc53dba-6cc53dc1 7889->7894 7890->7889 7898 6cc53d50-6cc53d57 7891->7898 7915 6cc53f75-6cc53fa1 7892->7915 7893->7880 7894->7887 7900 6cc53dd7-6cc53ddc 7894->7900 7901 6cc53e31 7895->7901 7902 6cc53c7b-6cc53cd0 7895->7902 7903 6cc53e1b-6cc53e24 7896->7903 7897->7872 7904 6cc53dd2 7897->7904 7898->7886 7907 6cc53e36-6cc53e3d 7900->7907 7908 6cc53dde-6cc53e17 7900->7908 7901->7864 7902->7898 7903->7897 7905 6cc53e76-6cc53e79 7903->7905 7904->7905 7905->7879 7911 6cc53e5c-6cc53e5f 7907->7911 7912 6cc53e3f-6cc53e5a 7907->7912 7908->7903 7911->7902 7914 6cc53e65-6cc53e69 7911->7914 7912->7903 7914->7897 7914->7905 7919 6cc54020-6cc54026 7915->7919 7920 6cc53fa3-6cc53fa8 7915->7920 7921 6cc53f06-6cc53f35 7919->7921 7922 6cc5402c-6cc5403c 7919->7922 7923 6cc5407c-6cc54081 7920->7923 7924 6cc53fae-6cc53fcf 7920->7924 7925 6cc53f38-6cc53f61 7921->7925 7926 6cc540b3-6cc540b8 7922->7926 7927 6cc5403e-6cc54058 7922->7927 7928 6cc54083-6cc5408a 7923->7928 7929 6cc540aa-6cc540ae 7923->7929 7924->7929 7930 6cc53f64-6cc53f67 7925->7930 7926->7924 7933 6cc540be-6cc540c9 7926->7933 7931 6cc5405a-6cc54063 7927->7931 7928->7925 7932 6cc54090 7928->7932 7934 6cc53f6b-6cc53f6f 7929->7934 7935 6cc53f69 7930->7935 7936 6cc540f5-6cc5413f 7931->7936 7937 6cc54069-6cc5406c 7931->7937 7932->7892 7938 6cc540a7 7932->7938 7933->7929 7939 6cc540cb-6cc540d4 7933->7939 7934->7915 7935->7934 7936->7935 7941 6cc54144-6cc5414b 7937->7941 7942 6cc54072-6cc54077 7937->7942 7938->7929 7939->7938 7943 6cc540d6-6cc540f0 7939->7943 7941->7934 7942->7930 7943->7931
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1087016a59ffe950506d07a835aeb372a5942833ff90bd87362bbc4349abf558
                              • Instruction ID: 1bc9e48efe7f1deffbc1244b7a65870eec888a2fe83aa4f15da7dff39b06c5ee
                              • Opcode Fuzzy Hash: 1087016a59ffe950506d07a835aeb372a5942833ff90bd87362bbc4349abf558
                              • Instruction Fuzzy Hash: B2320332245B018FC324CF29C880695B7E3FFD13147AD8A6DC0EA4BA95E775B46ACB54
                              Function 6CC53A6A Relevance: 3.1, APIs: 2, Instructions: 148threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7969 6cc53a6a-6cc53a85 7970 6cc53a87-6cc53aa7 7969->7970 7971 6cc53aa9-6cc53ab0 7970->7971 7972 6cc53960-6cc53964 7971->7972 7973 6cc53860-6cc5388e 7972->7973 7974 6cc5396a 7972->7974 7983 6cc53894-6cc53896 7973->7983 7984 6cc53970-6cc5397d 7973->7984 7975 6cc53ba1-6cc53bb6 7974->7975 7978 6cc53bc0-6cc53bda call 6cda19e0 call 6cda19f0 7975->7978 7990 6cc53be0-6cc53bfe 7978->7990 7983->7984 7989 6cc5389c-6cc538b9 7983->7989 7987 6cc539f1-6cc539f8 7984->7987 7988 6cc5397f-6cc53989 7984->7988 7992 6cc53ab5-6cc53aba 7987->7992 7993 6cc539fe-6cc53a03 7987->7993 7988->7989 7991 6cc5398f-6cc53994 7988->7991 7994 6cc538c0-6cc538c1 7989->7994 8010 6cc53c04-6cc53c11 7990->8010 8011 6cc53e7b 7990->8011 7996 6cc53b16-6cc53b18 7991->7996 7997 6cc5399a-6cc5399f 7991->7997 7992->7989 8001 6cc53ac0-6cc53ac7 7992->8001 7998 6cc538d2-6cc538d4 7993->7998 7999 6cc53a09-6cc53a2f 7993->7999 8000 6cc5395e 7994->8000 7996->7994 8003 6cc539a5-6cc539bf 7997->8003 8004 6cc5383b-6cc53855 call 6cda19e0 call 6cda19f0 7997->8004 8007 6cc53957-6cc5395c 7998->8007 8005 6cc53a35-6cc53a3a 7999->8005 8006 6cc538f8-6cc53955 7999->8006 8000->7972 8001->7994 8008 6cc53acd-6cc53ad6 8001->8008 8012 6cc53a5a-6cc53a5d 8003->8012 8004->7973 8013 6cc53a40-6cc53a57 8005->8013 8014 6cc53b1d-6cc53b22 8005->8014 8006->8007 8007->8000 8008->7996 8009 6cc53ad8-6cc53aeb 8008->8009 8009->8006 8016 6cc53af1-6cc53af8 8009->8016 8017 6cc53c17-6cc53c20 8010->8017 8018 6cc53ce0-6cc53cea 8010->8018 8021 6cc53e81-6cc53ee0 call 6cc53750 GetCurrentThread NtSetInformationThread 8011->8021 8012->7971 8013->8012 8019 6cc53b24-6cc53b44 8014->8019 8020 6cc53b49-6cc53b50 8014->8020 8024 6cc53b62-6cc53b85 8016->8024 8025 6cc53afa-6cc53aff 8016->8025 8026 6cc53dc5 8017->8026 8027 6cc53c26-6cc53c2d 8017->8027 8029 6cc53cec-6cc53d0c 8018->8029 8030 6cc53d3a-6cc53d3c 8018->8030 8019->7970 8020->7994 8028 6cc53b56-6cc53b5d 8020->8028 8041 6cc53eea-6cc53f04 call 6cda19e0 call 6cda19f0 8021->8041 8024->8006 8037 6cc53b8b 8024->8037 8025->8007 8034 6cc53dc6 8026->8034 8035 6cc53dc3 8027->8035 8036 6cc53c33-6cc53c3a 8027->8036 8028->7972 8038 6cc53d90-6cc53d95 8029->8038 8039 6cc53d70-6cc53d8d 8030->8039 8040 6cc53d3e-6cc53d45 8030->8040 8046 6cc53dc8-6cc53dcc 8034->8046 8035->8026 8044 6cc53e26-6cc53e2b 8036->8044 8045 6cc53c40-6cc53c5b 8036->8045 8037->7975 8042 6cc53d97-6cc53db8 8038->8042 8043 6cc53dba-6cc53dc1 8038->8043 8039->8038 8047 6cc53d50-6cc53d57 8040->8047 8064 6cc53f75-6cc53fa1 8041->8064 8042->8026 8043->8035 8049 6cc53dd7-6cc53ddc 8043->8049 8050 6cc53e31 8044->8050 8051 6cc53c7b-6cc53cd0 8044->8051 8052 6cc53e1b-6cc53e24 8045->8052 8046->7990 8053 6cc53dd2 8046->8053 8047->8034 8056 6cc53e36-6cc53e3d 8049->8056 8057 6cc53dde-6cc53e17 8049->8057 8050->7978 8051->8047 8052->8046 8054 6cc53e76-6cc53e79 8052->8054 8053->8054 8054->8021 8060 6cc53e5c-6cc53e5f 8056->8060 8061 6cc53e3f-6cc53e5a 8056->8061 8057->8052 8060->8051 8063 6cc53e65-6cc53e69 8060->8063 8061->8052 8063->8046 8063->8054 8068 6cc54020-6cc54026 8064->8068 8069 6cc53fa3-6cc53fa8 8064->8069 8070 6cc53f06-6cc53f35 8068->8070 8071 6cc5402c-6cc5403c 8068->8071 8072 6cc5407c-6cc54081 8069->8072 8073 6cc53fae-6cc53fcf 8069->8073 8074 6cc53f38-6cc53f61 8070->8074 8075 6cc540b3-6cc540b8 8071->8075 8076 6cc5403e-6cc54058 8071->8076 8077 6cc54083-6cc5408a 8072->8077 8078 6cc540aa-6cc540ae 8072->8078 8073->8078 8079 6cc53f64-6cc53f67 8074->8079 8075->8073 8082 6cc540be-6cc540c9 8075->8082 8080 6cc5405a-6cc54063 8076->8080 8077->8074 8081 6cc54090 8077->8081 8083 6cc53f6b-6cc53f6f 8078->8083 8084 6cc53f69 8079->8084 8085 6cc540f5-6cc5413f 8080->8085 8086 6cc54069-6cc5406c 8080->8086 8081->8041 8087 6cc540a7 8081->8087 8082->8078 8088 6cc540cb-6cc540d4 8082->8088 8083->8064 8084->8083 8085->8084 8090 6cc54144-6cc5414b 8086->8090 8091 6cc54072-6cc54077 8086->8091 8087->8078 8088->8087 8092 6cc540d6-6cc540f0 8088->8092 8090->8083 8091->8079 8092->8080
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CurrentThread
                              • String ID:
                              • API String ID: 2882836952-0
                              • Opcode ID: 653b239f9fc461f2953ac5511e3b5f8a705dc422d30673f409a8f904f0dd446c
                              • Instruction ID: 0b11a418609cc070eae0bdc0f00ae4ef03bf8d818d1835651cbfd886f89bca9c
                              • Opcode Fuzzy Hash: 653b239f9fc461f2953ac5511e3b5f8a705dc422d30673f409a8f904f0dd446c
                              • Instruction Fuzzy Hash: B651FF316047018FC320CF29C880786B7E3BF91314FA98B5DC0E65BA91EB75B46ACB55
                              Function 6CC539CF Relevance: 3.1, APIs: 2, Instructions: 139threadCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CurrentThread
                              • String ID:
                              • API String ID: 2882836952-0
                              • Opcode ID: 36a2adecf5cbc59a7b31b6a3c251337f08c4511f118beaff91f18edc35a40f1e
                              • Instruction ID: c520b03528a9d23a56c291e11d490c5b640210c7e9c8b8a3acf00d99e75763ec
                              • Opcode Fuzzy Hash: 36a2adecf5cbc59a7b31b6a3c251337f08c4511f118beaff91f18edc35a40f1e
                              • Instruction Fuzzy Hash: F751EF31604B018FC320CF29C480796B7E3BF95314FA98B5DC0E65BA95EB71B46A8B95
                              Function 6CC53D18 Relevance: 3.1, APIs: 2, Instructions: 89threadnativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThread.KERNEL32 ref: 6CC53E9D
                              • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6CC53EAA
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Thread$CurrentInformation
                              • String ID:
                              • API String ID: 1650627709-0
                              • Opcode ID: 4487eb9631c9bf6c5eca63f04b22e51aa8bca41ea8d6ce8f883e1094896baaf5
                              • Instruction ID: 462368a0211b45b106ef537ad464ba76c5db0c33deb6f4dacc24dcdfe7dbc5c9
                              • Opcode Fuzzy Hash: 4487eb9631c9bf6c5eca63f04b22e51aa8bca41ea8d6ce8f883e1094896baaf5
                              • Instruction Fuzzy Hash: 1A312031205B018BC320CF28C8847C6B7B3BF92314FA94A5DC0A64BA81EB75743A9B55
                              Function 6CC53D62 Relevance: 3.1, APIs: 2, Instructions: 83threadnativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThread.KERNEL32 ref: 6CC53E9D
                              • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6CC53EAA
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Thread$CurrentInformation
                              • String ID:
                              • API String ID: 1650627709-0
                              • Opcode ID: 930059834d1bed94e6007112177873c5e20d6e91a551c0d1edde8ac0d5d5409a
                              • Instruction ID: 39880ffdc7464a26df0bec7ded62b34c40b86d3b494fc1b59d5c9102265082ea
                              • Opcode Fuzzy Hash: 930059834d1bed94e6007112177873c5e20d6e91a551c0d1edde8ac0d5d5409a
                              • Instruction Fuzzy Hash: 71310F31114701CBC720CF28C880796B7B6BF92304FA94A5DC0E68BA81EB717475CB55
                              Function 6CC53C62 Relevance: 3.1, APIs: 2, Instructions: 72threadnativeCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentThread.KERNEL32 ref: 6CC53E9D
                              • NtSetInformationThread.NTDLL(00000000,00000011,00000000,00000000), ref: 6CC53EAA
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Thread$CurrentInformation
                              • String ID:
                              • API String ID: 1650627709-0
                              • Opcode ID: 5197875f384bca105b002cc931c6c55d213d986dc93ebc3ecdc1f1ed535f78be
                              • Instruction ID: 443654669981dacab40a319f5248993bb4f1f1c9ec7dd70c4c4dfab6c4cbcc07
                              • Opcode Fuzzy Hash: 5197875f384bca105b002cc931c6c55d213d986dc93ebc3ecdc1f1ed535f78be
                              • Instruction Fuzzy Hash: F7212430218701CBD324CF74C890796B7B6BF92304FA84B5DC0A68BAD1EB71B4358B55
                              Function 6CDD5690 Relevance: 3.1, APIs: 2, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerA.SECHOST(00000000,00000000,00000001), ref: 6CDD56A0
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ManagerOpen
                              • String ID:
                              • API String ID: 1889721586-0
                              • Opcode ID: 0eb1e4515855809047adb4a9f8a08c5097d035f038aa3fe7c92766898221ad86
                              • Instruction ID: f918f39b9e07ee09763c708e15e475f47697ac3b6de31955d64f6bca3d155eec
                              • Opcode Fuzzy Hash: 0eb1e4515855809047adb4a9f8a08c5097d035f038aa3fe7c92766898221ad86
                              • Instruction Fuzzy Hash: F1312CB4A08341EFC700DF28D584B0ABBF0EB89765F51885EF999C6361D371E8489B63
                              Function 6CDCB430 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileA.KERNEL32(?,?), ref: 6CDCB44C
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: FileFindFirst
                              • String ID:
                              • API String ID: 1974802433-0
                              • Opcode ID: 13c3bbf25cec0471c8326d248ef7d1fe92bc3822cef11a6f24697210c31bc0d5
                              • Instruction ID: 3c1c076cf5ede17547297718925257be83567890f8b9248e1189c76fe923b4d5
                              • Opcode Fuzzy Hash: 13c3bbf25cec0471c8326d248ef7d1fe92bc3822cef11a6f24697210c31bc0d5
                              • Instruction Fuzzy Hash: 0811197460C350ABD7008B24D54450E7BE8AB85329F148E5DF4A8C76E1D334C8858B03
                              Function 6CDAAFA0 Relevance: 44.5, APIs: 3, Strings: 22, Instructions: 734fileCOMMON
                              Download Yara Rule
                              APIs
                              • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 6CDAB117
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: FileRead
                              • String ID: $53N!$53N!$H$I_#]$J_#]$J_#]$Y<Uq$Y<Uq$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$\|n/$f@n`$f@n`$jinc$|
                              • API String ID: 2738559852-1563143607
                              • Opcode ID: f21d38ade10b1dec0c15f0854e34be6352ec2b950ac5f39106bdbdd45abfe762
                              • Instruction ID: 14c8f88da215f3e6ad1bac45aef3b197fc60b9a1d73236101c151d52d0fba73d
                              • Opcode Fuzzy Hash: f21d38ade10b1dec0c15f0854e34be6352ec2b950ac5f39106bdbdd45abfe762
                              • Instruction Fuzzy Hash: 7C625970609385EFC724CF69C490A5ABBE1ABCA314F148D1EE4E9CB7A0D735D8478B46
                              Function 6CDED043 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 6824 6cded043-6cded053 6825 6cded06d-6cded06f 6824->6825 6826 6cded055-6cded068 call 6cddff4f call 6cddff3c 6824->6826 6828 6cded3d4-6cded3e1 call 6cddff4f call 6cddff3c 6825->6828 6829 6cded075-6cded07b 6825->6829 6842 6cded3ec 6826->6842 6848 6cded3e7 call 6cde0690 6828->6848 6829->6828 6832 6cded081-6cded0a7 6829->6832 6832->6828 6835 6cded0ad-6cded0b6 6832->6835 6838 6cded0b8-6cded0cb call 6cddff4f call 6cddff3c 6835->6838 6839 6cded0d0-6cded0d2 6835->6839 6838->6848 6840 6cded0d8-6cded0db 6839->6840 6841 6cded3d0-6cded3d2 6839->6841 6840->6841 6847 6cded0e1-6cded0e5 6840->6847 6845 6cded3ef-6cded3f2 6841->6845 6842->6845 6847->6838 6850 6cded0e7-6cded0fe 6847->6850 6848->6842 6853 6cded14f-6cded155 6850->6853 6854 6cded100-6cded103 6850->6854 6855 6cded11b-6cded132 call 6cddff4f call 6cddff3c call 6cde0690 6853->6855 6856 6cded157-6cded161 6853->6856 6857 6cded105-6cded10e 6854->6857 6858 6cded113-6cded119 6854->6858 6886 6cded307 6855->6886 6859 6cded168-6cded186 call 6cde4d65 call 6cde4d2b * 2 6856->6859 6860 6cded163-6cded165 6856->6860 6861 6cded1d3-6cded1e3 6857->6861 6858->6855 6863 6cded137-6cded14a 6858->6863 6898 6cded188-6cded19e call 6cddff3c call 6cddff4f 6859->6898 6899 6cded1a3-6cded1cc call 6cdeb1d9 6859->6899 6860->6859 6864 6cded2a8-6cded2b1 call 6cdf1f55 6861->6864 6865 6cded1e9-6cded1f5 6861->6865 6863->6861 6876 6cded324 6864->6876 6877 6cded2b3-6cded2c5 6864->6877 6865->6864 6869 6cded1fb-6cded1fd 6865->6869 6869->6864 6873 6cded203-6cded227 6869->6873 6873->6864 6879 6cded229-6cded23f 6873->6879 6885 6cded328-6cded340 ReadFile 6876->6885 6877->6876 6882 6cded2c7-6cded2d6 GetConsoleMode 6877->6882 6879->6864 6883 6cded241-6cded243 6879->6883 6882->6876 6889 6cded2d8-6cded2dc 6882->6889 6883->6864 6891 6cded245-6cded26b 6883->6891 6887 6cded39c-6cded3a7 GetLastError 6885->6887 6888 6cded342-6cded348 6885->6888 6897 6cded30a-6cded314 call 6cde4d2b 6886->6897 6893 6cded3a9-6cded3bb call 6cddff3c call 6cddff4f 6887->6893 6894 6cded3c0-6cded3c3 6887->6894 6888->6887 6892 6cded34a 6888->6892 6889->6885 6895 6cded2de-6cded2f8 ReadConsoleW 6889->6895 6891->6864 6896 6cded26d-6cded283 6891->6896 6901 6cded34d-6cded35f 6892->6901 6893->6886 6905 6cded3c9-6cded3cb 6894->6905 6906 6cded300-6cded306 call 6cddff62 6894->6906 6903 6cded2fa GetLastError 6895->6903 6904 6cded319-6cded322 6895->6904 6896->6864 6909 6cded285-6cded287 6896->6909 6897->6845 6898->6886 6899->6861 6901->6897 6910 6cded361-6cded365 6901->6910 6903->6906 6904->6901 6905->6897 6906->6886 6909->6864 6914 6cded289-6cded2a3 6909->6914 6918 6cded37e-6cded389 6910->6918 6919 6cded367-6cded377 call 6cded46e 6910->6919 6914->6864 6925 6cded38b call 6cded3f3 6918->6925 6926 6cded395-6cded39a call 6cded726 6918->6926 6930 6cded37a-6cded37c 6919->6930 6931 6cded390-6cded393 6925->6931 6926->6931 6930->6897 6931->6930
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8Q
                              • API String ID: 0-4022487301
                              • Opcode ID: 932442a947f38e531e708db4d7c6f69bcf0fd6e18aaabde8e4ac404856958b45
                              • Instruction ID: 3dbc0e691e80464a8efc3b736027b1da88256333cd779f4b9c47fef116db7ae3
                              • Opcode Fuzzy Hash: 932442a947f38e531e708db4d7c6f69bcf0fd6e18aaabde8e4ac404856958b45
                              • Instruction Fuzzy Hash: 22C1D470E05249EFDF01CFA8C880BADBBB4EF8E314F504159E454ABBA1CB71A945CB61
                              Function 6CDF45DC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 6933 6cdf45dc-6cdf460c call 6cdf4a5c 6936 6cdf460e-6cdf4619 call 6cddff4f 6933->6936 6937 6cdf4627-6cdf4633 call 6cdf1b7c 6933->6937 6942 6cdf461b-6cdf4622 call 6cddff3c 6936->6942 6943 6cdf464c-6cdf4695 call 6cdf49c7 6937->6943 6944 6cdf4635-6cdf464a call 6cddff4f call 6cddff3c 6937->6944 6954 6cdf4901-6cdf4905 6942->6954 6952 6cdf4697-6cdf46a0 6943->6952 6953 6cdf4702-6cdf470b GetFileType 6943->6953 6944->6942 6958 6cdf46d7-6cdf46fd GetLastError call 6cddff62 6952->6958 6959 6cdf46a2-6cdf46a6 6952->6959 6955 6cdf470d-6cdf473e GetLastError call 6cddff62 CloseHandle 6953->6955 6956 6cdf4754-6cdf4757 6953->6956 6955->6942 6970 6cdf4744-6cdf474f call 6cddff3c 6955->6970 6961 6cdf4759-6cdf475e 6956->6961 6962 6cdf4760-6cdf4766 6956->6962 6958->6942 6959->6958 6963 6cdf46a8-6cdf46d5 call 6cdf49c7 6959->6963 6966 6cdf476a-6cdf47b8 call 6cdf1d20 6961->6966 6962->6966 6967 6cdf4768 6962->6967 6963->6953 6963->6958 6976 6cdf47ba-6cdf47c6 call 6cdf4bd6 6966->6976 6977 6cdf47d7-6cdf47ff call 6cdf4c80 6966->6977 6967->6966 6970->6942 6976->6977 6982 6cdf47c8 6976->6982 6983 6cdf4804-6cdf4845 6977->6983 6984 6cdf4801-6cdf4802 6977->6984 6985 6cdf47ca-6cdf47d2 call 6cdebe95 6982->6985 6986 6cdf4847-6cdf484b 6983->6986 6987 6cdf4866-6cdf4874 6983->6987 6984->6985 6985->6954 6986->6987 6989 6cdf484d-6cdf4861 6986->6989 6990 6cdf48ff 6987->6990 6991 6cdf487a-6cdf487e 6987->6991 6989->6987 6990->6954 6991->6990 6993 6cdf4880-6cdf48b3 CloseHandle call 6cdf49c7 6991->6993 6996 6cdf48e7-6cdf48fb 6993->6996 6997 6cdf48b5-6cdf48e1 GetLastError call 6cddff62 call 6cdf1c8f 6993->6997 6996->6990 6997->6996
                              APIs
                                • Part of subcall function 6CDF49C7: CreateFileW.KERNEL32(00000000,00000000,?,6CDF4685,?,?,00000000,?,6CDF4685,00000000,0000000C), ref: 6CDF49E4
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDF46F0
                              • __dosmaperr.LIBCMT ref: 6CDF46F7
                              • GetFileType.KERNEL32(00000000), ref: 6CDF4703
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDF470D
                              • __dosmaperr.LIBCMT ref: 6CDF4716
                              • CloseHandle.KERNEL32(00000000), ref: 6CDF4736
                              • CloseHandle.KERNEL32(6CDEB640), ref: 6CDF4883
                              • GetLastError.KERNEL32 ref: 6CDF48B5
                              • __dosmaperr.LIBCMT ref: 6CDF48BC
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                              • String ID: 8Q
                              • API String ID: 4237864984-4022487301
                              • Opcode ID: 11d7ed0ef5ea6d83f592fdb8c0a29d5b3bb00a40e197e6293cbca980dcd5f51f
                              • Instruction ID: e91c57520b5288adcacfd73b07b69634f9909dcec8f1394dbae2088f4c4847c7
                              • Opcode Fuzzy Hash: 11d7ed0ef5ea6d83f592fdb8c0a29d5b3bb00a40e197e6293cbca980dcd5f51f
                              • Instruction Fuzzy Hash: 7AA12732A141488FCF099F78DA517ED7BB1BB07328F1A015DE821AB7A0D735991BCB61
                              Function 6CDAC750 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 183COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7002 6cdac750-6cdac7a9 call 6cdd70e0 7005 6cdac7d0-6cdac7d9 7002->7005 7006 6cdac7db-6cdac7e0 7005->7006 7007 6cdac820-6cdac825 7005->7007 7008 6cdac7e2-6cdac7e7 7006->7008 7009 6cdac860-6cdac865 7006->7009 7010 6cdac8a0-6cdac8a5 7007->7010 7011 6cdac827-6cdac82c 7007->7011 7016 6cdac7ed-6cdac7f2 7008->7016 7017 6cdac8e2-6cdac94f WriteFile 7008->7017 7012 6cdac86b-6cdac870 7009->7012 7013 6cdac9a1-6cdac9b8 WriteFile 7009->7013 7014 6cdac8ab-6cdac8b0 7010->7014 7015 6cdac9f9-6cdaca29 call 6cddb910 7010->7015 7018 6cdac832-6cdac837 7011->7018 7019 6cdac977-6cdac98b 7011->7019 7020 6cdac9c2-6cdac9ef call 6cddbe90 ReadFile 7012->7020 7021 6cdac876-6cdac87b 7012->7021 7013->7020 7023 6cdaca2e-6cdaca33 7014->7023 7024 6cdac8b6-6cdac8dd 7014->7024 7015->7005 7025 6cdac7f8-6cdac7fd 7016->7025 7026 6cdac959-6cdac96d WriteFile 7016->7026 7017->7026 7028 6cdac7ab-6cdac7c0 7018->7028 7029 6cdac83d-6cdac842 7018->7029 7027 6cdac98f-6cdac99c 7019->7027 7020->7015 7021->7005 7031 6cdac881-6cdac89b 7021->7031 7023->7005 7034 6cdaca39-6cdaca47 7023->7034 7032 6cdac7c3-6cdac7c8 7024->7032 7025->7005 7035 6cdac7ff-6cdac81a 7025->7035 7026->7019 7027->7005 7028->7032 7029->7005 7036 6cdac844-6cdac857 7029->7036 7031->7027 7032->7005 7035->7032 7036->7032
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: :uW$;uW$;uW$> 4!$> 4!
                              • API String ID: 0-4100612575
                              • Opcode ID: fdddac7b19820e5bdbf9b3214ae1554d57560783980a035c99f84eaafb6df1d8
                              • Instruction ID: 45e81f80bbfbd50215aef4fa3f00896ecc9af8b992f7f8433e643b775f64c842
                              • Opcode Fuzzy Hash: fdddac7b19820e5bdbf9b3214ae1554d57560783980a035c99f84eaafb6df1d8
                              • Instruction Fuzzy Hash: A5716DB0208345EFD710EF59C480BAABBF5BF89718F10492EF494D6661D772D8898B92
                              Function 6CDABCA0 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 605COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: K?Jo$K?Jo$`Rlx$7eO
                              • API String ID: 0-174837320
                              • Opcode ID: 27f93190dafc6a1ca81239d2f2188fe1d01ee818cde4d834eb7749797fef6eb6
                              • Instruction ID: dd2bc865ba88d0645247eda727aaffda64a42fb6d89481c47fa4e2bafdcc763a
                              • Opcode Fuzzy Hash: 27f93190dafc6a1ca81239d2f2188fe1d01ee818cde4d834eb7749797fef6eb6
                              • Instruction Fuzzy Hash: E0426574609346DFCB14DF98C08061ABBE1AFC9318F248D5EE5A687BA0D739D846CB53
                              Function 6CC54200 Relevance: 9.0, APIs: 3, Strings: 1, Instructions: 2005COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: ;T55
                              • API String ID: 0-2572755013
                              • Opcode ID: 45d87d1784537bce7054fcba23a7e99749c723f03ac324818dc6cc2c334ff12f
                              • Instruction ID: deacac331d32374d270fd3bf2634091079f52f171440f1a365817d3fdd08fc55
                              • Opcode Fuzzy Hash: 45d87d1784537bce7054fcba23a7e99749c723f03ac324818dc6cc2c334ff12f
                              • Instruction Fuzzy Hash: 8303F131644B018FC728CF2AC8D0696B7E3FFD53247598A6DC0A64BE95EB74B44ACB50
                              Function 6CDD5560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62processCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7579 6cdd5560-6cdd55e7 CreateProcessA 7580 6cdd563a-6cdd5643 7579->7580 7581 6cdd5645-6cdd564a 7580->7581 7582 6cdd5660-6cdd567b 7580->7582 7583 6cdd564c-6cdd5651 7581->7583 7584 6cdd55f0-6cdd5632 WaitForSingleObject CloseHandle * 2 7581->7584 7582->7580 7583->7580 7585 6cdd5653-6cdd5688 7583->7585 7584->7580
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CreateProcess
                              • String ID: D
                              • API String ID: 963392458-2746444292
                              • Opcode ID: 953395fb7f603289d84450a2923972ebcf978963f7f7c91b024a08b8b5a76934
                              • Instruction ID: cf1fbc8fa34a5008145f4e5545887d45508005ff84bdfe0e50da22a171f9c8d0
                              • Opcode Fuzzy Hash: 953395fb7f603289d84450a2923972ebcf978963f7f7c91b024a08b8b5a76934
                              • Instruction Fuzzy Hash: BE31E3B0819380CFE740DF28D19871ABBF0EB9A318F415A1EF4D996260E774A588CF43
                              Function 6CDEC1CE Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177fileCOMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7587 6cdec1ce-6cdec1ea 7588 6cdec3a9 7587->7588 7589 6cdec1f0-6cdec1f2 7587->7589 7590 6cdec3ab-6cdec3af 7588->7590 7591 6cdec214-6cdec235 7589->7591 7592 6cdec1f4-6cdec207 call 6cddff4f call 6cddff3c call 6cde0690 7589->7592 7594 6cdec23c-6cdec242 7591->7594 7595 6cdec237-6cdec23a 7591->7595 7609 6cdec20c-6cdec20f 7592->7609 7594->7592 7597 6cdec244-6cdec249 7594->7597 7595->7594 7595->7597 7599 6cdec25a-6cdec26b call 6cdec3b0 7597->7599 7600 6cdec24b-6cdec257 call 6cdeb1d9 7597->7600 7607 6cdec2ac-6cdec2be 7599->7607 7608 6cdec26d-6cdec26f 7599->7608 7600->7599 7612 6cdec305-6cdec327 WriteFile 7607->7612 7613 6cdec2c0-6cdec2c9 7607->7613 7610 6cdec296-6cdec2a2 call 6cdec421 7608->7610 7611 6cdec271-6cdec279 7608->7611 7609->7590 7626 6cdec2a7-6cdec2aa 7610->7626 7616 6cdec27f-6cdec28c call 6cdec7cb 7611->7616 7617 6cdec33b-6cdec33e 7611->7617 7619 6cdec329-6cdec32f GetLastError 7612->7619 7620 6cdec332 7612->7620 7614 6cdec2cb-6cdec2ce 7613->7614 7615 6cdec2f5-6cdec303 call 6cdec833 7613->7615 7622 6cdec2e5-6cdec2f3 call 6cdec9f7 7614->7622 7623 6cdec2d0-6cdec2d3 7614->7623 7615->7626 7634 6cdec28f-6cdec291 7616->7634 7621 6cdec341-6cdec346 7617->7621 7619->7620 7627 6cdec335-6cdec33a 7620->7627 7628 6cdec348-6cdec34d 7621->7628 7629 6cdec3a4-6cdec3a7 7621->7629 7622->7626 7623->7621 7630 6cdec2d5-6cdec2e3 call 6cdec90e 7623->7630 7626->7634 7627->7617 7635 6cdec34f-6cdec354 7628->7635 7636 6cdec379-6cdec385 7628->7636 7629->7590 7630->7626 7634->7627 7639 6cdec36d-6cdec374 call 6cddff62 7635->7639 7640 6cdec356-6cdec368 call 6cddff3c call 6cddff4f 7635->7640 7642 6cdec38c-6cdec39f call 6cddff3c call 6cddff4f 7636->7642 7643 6cdec387-6cdec38a 7636->7643 7639->7609 7640->7609 7642->7609 7643->7588 7643->7642
                              APIs
                                • Part of subcall function 6CDEC421: GetConsoleCP.KERNEL32(?,6CDEB640,?), ref: 6CDEC469
                              • WriteFile.KERNEL32(?,?,6CDF4C5C,00000000,00000000,?,00000000,00000000,6CDF6026,00000000,00000000,?,00000000,6CDEB640,6CDF4C5C,00000000), ref: 6CDEC31F
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,6CDF4C5C,6CDEB640,00000000,?,?,?,?,00000000,?), ref: 6CDEC329
                              • __dosmaperr.LIBCMT ref: 6CDEC36E
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ConsoleErrorFileLastWrite__dosmaperr
                              • String ID: 8Q
                              • API String ID: 251514795-4022487301
                              • Opcode ID: 93b710e620028b40d755ee68684f15badc298ca665cd6043cecbc17f8d7a5c51
                              • Instruction ID: 592fdee88a4ed733cb2e9bab6c719ed301e7faa1af9b4ec718622913250bf679
                              • Opcode Fuzzy Hash: 93b710e620028b40d755ee68684f15badc298ca665cd6043cecbc17f8d7a5c51
                              • Instruction Fuzzy Hash: C7519171A0520AEFDB01ABE8C840BEFBFB9FF8E358F140155E410ABA61D77099458761
                              Function 6CDD6100 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7654 6cdd6100-6cdd610c 7655 6cdd614d 7654->7655 7656 6cdd610e-6cdd6119 7654->7656 7659 6cdd614f-6cdd61c7 7655->7659 7657 6cdd612f-6cdd613c call 6cca01f0 call 6cde1088 7656->7657 7658 6cdd611b-6cdd612d 7656->7658 7667 6cdd6141-6cdd614b 7657->7667 7658->7657 7661 6cdd61c9-6cdd61f1 7659->7661 7662 6cdd61f3-6cdd61f9 7659->7662 7661->7662 7664 6cdd61fa-6cdd62b9 call 6cca2250 call 6cca2340 call 6cdd98e9 call 6cc9e010 call 6cdd75f8 7661->7664 7667->7659
                              APIs
                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CDD62A1
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Ios_base_dtorstd::ios_base::_
                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                              • API String ID: 323602529-1866435925
                              • Opcode ID: 34ed1eb1dd61d77b76978abab0ba0198d5e576bfe7637b7e0a6c7f94d9ead42a
                              • Instruction ID: d85ab65cd1395dcefa78e0027c749d3766f83ce2563ddb6b83d8c1f7c8bf154d
                              • Opcode Fuzzy Hash: 34ed1eb1dd61d77b76978abab0ba0198d5e576bfe7637b7e0a6c7f94d9ead42a
                              • Instruction Fuzzy Hash: A35143B5A00B008FD725CF29C495B97BBF1BB48318F118A2DD88647BA1D775B90ACF90
                              Function 6CDEBE95 Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7699 6cdebe95-6cdebea9 call 6cdf1b12 7702 6cdebeaf-6cdebeb7 7699->7702 7703 6cdebeab-6cdebead 7699->7703 7705 6cdebeb9-6cdebec0 7702->7705 7706 6cdebec2-6cdebec5 7702->7706 7704 6cdebefd-6cdebf1d call 6cdf1c8f 7703->7704 7714 6cdebf1f-6cdebf29 call 6cddff62 7704->7714 7715 6cdebf2b 7704->7715 7705->7706 7708 6cdebecd-6cdebee1 call 6cdf1b12 * 2 7705->7708 7709 6cdebec7-6cdebecb 7706->7709 7710 6cdebee3-6cdebef3 call 6cdf1b12 CloseHandle 7706->7710 7708->7703 7708->7710 7709->7708 7709->7710 7710->7703 7721 6cdebef5-6cdebefb GetLastError 7710->7721 7719 6cdebf2d-6cdebf30 7714->7719 7715->7719 7721->7704
                              APIs
                              • CloseHandle.KERNEL32(00000000,?,00000000,?,6CDF47CF), ref: 6CDEBEEB
                              • GetLastError.KERNEL32(?,00000000,?,6CDF47CF), ref: 6CDEBEF5
                              • __dosmaperr.LIBCMT ref: 6CDEBF20
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CloseErrorHandleLast__dosmaperr
                              • String ID:
                              • API String ID: 2583163307-0
                              • Opcode ID: 78bc39999ba96c69ee6a852f67931279a9a4c2fc5a90de20550249939cd77697
                              • Instruction ID: e212f42efeca0f238256a66a18acd7e7ad8484354b5dfe23ad739efd34b130e7
                              • Opcode Fuzzy Hash: 78bc39999ba96c69ee6a852f67931279a9a4c2fc5a90de20550249939cd77697
                              • Instruction Fuzzy Hash: 53016B33709710B6C2001B399544BBD27AD9B8BF3CF3B074DEA24A7AF1DB61E84541A4
                              Function 6CDE110C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 7944 6cde110c-6cde1117 7945 6cde112e-6cde113b 7944->7945 7946 6cde1119-6cde112c call 6cddff3c call 6cde0690 7944->7946 7947 6cde113d-6cde1152 call 6cde1229 call 6cde8cae call 6cdea1d0 call 6cdebe08 7945->7947 7948 6cde1176-6cde117f call 6cdeb3e5 7945->7948 7957 6cde1180-6cde1182 7946->7957 7963 6cde1157-6cde115c 7947->7963 7948->7957 7964 6cde115e-6cde1161 7963->7964 7965 6cde1163-6cde1167 7963->7965 7964->7948 7965->7948 7966 6cde1169-6cde1175 call 6cde4d2b 7965->7966 7966->7948
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8Q
                              • API String ID: 0-4022487301
                              • Opcode ID: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                              • Instruction ID: f026fae743f65bcf807ab045068f16a8bc05965c19694660bb08df23334252fd
                              • Opcode Fuzzy Hash: 0eceabb69cc212cdc16fe4ea4eed4d534fb07063be66ce5869ee3001f537518c
                              • Instruction Fuzzy Hash: 19F0A932A026146AD6211B79DC007CB32A89F4B379F114716E47592FF1DB74E40AC6F5
                              Function 6CDD5ED0 Relevance: 3.1, APIs: 2, Instructions: 108COMMON
                              Download Yara Rule
                              APIs
                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CDD6024
                              • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6CDD6064
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: Ios_base_dtorstd::ios_base::_
                              • String ID:
                              • API String ID: 323602529-0
                              • Opcode ID: deefea3d2db9590e8838bc3fae842ec36bd6ace9457879a90c3294b89361d9e6
                              • Instruction ID: a7cbd324da5f2b3f2846929873fa422594b532ad2413b527c435dab9127fbe86
                              • Opcode Fuzzy Hash: deefea3d2db9590e8838bc3fae842ec36bd6ace9457879a90c3294b89361d9e6
                              • Instruction Fuzzy Hash: 535127B1501B00DBD725CF25C884BD6BBE4FB04718F458A5DE4AA8BBA1DB30B549CB91
                              Function 6CDDF4AF Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(6CE06DF0,0000000C), ref: 6CDDF4C2
                              • ExitThread.KERNEL32 ref: 6CDDF4C9
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: ErrorExitLastThread
                              • String ID:
                              • API String ID: 1611280651-0
                              • Opcode ID: c78a619e58de1e0470156b4839513ccf750c36574fc9d4e7a429313b765165d8
                              • Instruction ID: e2c125217741ad68a129d8cd205de5208af5040fb38714d352fcd72170f90c3d
                              • Opcode Fuzzy Hash: c78a619e58de1e0470156b4839513ccf750c36574fc9d4e7a429313b765165d8
                              • Instruction Fuzzy Hash: EEF0AF71A00201AFEB01AFB0C848AAE3B74FF05319F26454EF50597B61CF356945CBB0
                              Function 6CDEB4E2 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __wsopen_s
                              • String ID:
                              • API String ID: 3347428461-0
                              • Opcode ID: 0d304e76a59ef53dcf4c4502c038aefe03b7f6535806b259a0f666c018b8f197
                              • Instruction ID: c4ede4e638dd2bdca91f580f3d57af4f777db9a6180f47ee44ee8083669cfdea
                              • Opcode Fuzzy Hash: 0d304e76a59ef53dcf4c4502c038aefe03b7f6535806b259a0f666c018b8f197
                              • Instruction Fuzzy Hash: 13114C72A0420EAFCF05DF59E9409DB7BF8EF49308F154069F809AB351D671E911CBA8
                              Function 6CDF456E Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: _free
                              • String ID:
                              • API String ID: 269201875-0
                              • Opcode ID: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                              • Instruction ID: 804d91ac276e0083ddf9de4d2c6a16f78fdc3b44252a7fb94d33332b42802d71
                              • Opcode Fuzzy Hash: be7da6dea50fa55462c2689bd82912a63b2abf68e9cf5535eb42c5cf9c623313
                              • Instruction Fuzzy Hash: 90014F72C0115DAFCF02AFE88D009EE7FB9BF08214F154165FA24E22A0E7318A25DB91
                              Function 6CDF49C7 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,00000000,?,6CDF4685,?,?,00000000,?,6CDF4685,00000000,0000000C), ref: 6CDF49E4
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 9f512ffb17c0b1abb01e8502457b6e37817ea07cbba7aba662b431535e221575
                              • Instruction ID: 0b04e4cbcd1ffd3e2c8475cc0ed5674bce55988aa81d9322b507b3f18e8dad44
                              • Opcode Fuzzy Hash: 9f512ffb17c0b1abb01e8502457b6e37817ea07cbba7aba662b431535e221575
                              • Instruction Fuzzy Hash: 74D06C3210010DBBDF029E84DD06EDA3BBAFB48714F024000BA1866020C732E871AB90
                              Function 6CCA7CB0 Relevance: 1.5, APIs: 1, Instructions: 1COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1557011095.000000006CC51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CC50000, based on PE: true
                              • Associated: 00000006.00000002.1556984160.000000006CC50000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558266561.000000006CDF8000.00000002.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1559662353.000000006CFC3000.00000002.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                              • Instruction ID: 5ffccb6bbbae6a6d24d8e521edb828775c2009af102de808ecadd10ba594c3f8
                              • Opcode Fuzzy Hash: a80223a001130716628e74e8086c402ab21fb308a8a87af2905342d4276af0b1
                              • Instruction Fuzzy Hash:

                              Non-executed Functions

                              Function 6CE7589F Relevance: 15.6, APIs: 6, Strings: 2, Instructions: 1591COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE758A4
                              • __aulldiv.LIBCMT ref: 6CE75C4A
                              • __aulldiv.LIBCMT ref: 6CE75C78
                              • __aulldiv.LIBCMT ref: 6CE75D18
                                • Part of subcall function 6CE7736D: __EH_prolog.LIBCMT ref: 6CE77372
                                • Part of subcall function 6CE7740E: __EH_prolog.LIBCMT ref: 6CE77413
                                • Part of subcall function 6CE76E78: __EH_prolog.LIBCMT ref: 6CE76E7D
                                • Part of subcall function 6CE7124A: __EH_prolog.LIBCMT ref: 6CE7124F
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog$__aulldiv
                              • String ID: L$b
                              • API String ID: 604474441-3566554212
                              • Opcode ID: d9657c234f8b039fc43015c1601217ec1c14bdfa2872b48e6b05b85763b47a84
                              • Instruction ID: a8141e893515fa5b0e48d6ccf80ed90e34415874cfe2fd5e44cc93fa29bb6274
                              • Opcode Fuzzy Hash: d9657c234f8b039fc43015c1601217ec1c14bdfa2872b48e6b05b85763b47a84
                              • Instruction Fuzzy Hash: 52E29A31D05299DFDF25CFA4C994ADCBBB4AF19308F24409ED449A7B81DB306E89CB61
                              Function 6CE684AC Relevance: 8.7, APIs: 1, Strings: 3, Instructions: 1656COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE684B1
                                • Part of subcall function 6CE6993B: __EH_prolog.LIBCMT ref: 6CE69940
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: 1$`)K$h)K
                              • API String ID: 3519838083-3935664338
                              • Opcode ID: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                              • Instruction ID: ec4f1eafdf3b8174a7709a28887449e3b64aa747fd4559be2f6bf28470980e9b
                              • Opcode Fuzzy Hash: fb81dbfa73f61bd15ec69b15b7f2714c80bc06e5f8e59c27703e0bd61042d5ed
                              • Instruction Fuzzy Hash: E5F28C30D40258DFDB11CFA9C888BDDBBB5AF49308F384099E449ABB81DB759A85CF51
                              Function 6CE5AEEF Relevance: 8.3, APIs: 1, Strings: 2, Instructions: 3058COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE5AEF4
                                • Part of subcall function 6CE5E622: __EH_prolog.LIBCMT ref: 6CE5E627
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $h%K
                              • API String ID: 3519838083-1737110039
                              • Opcode ID: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                              • Instruction ID: dccb62b27b8ad8b8e406d008320a7e040d9fbf23fe9f13ae088e34a1569a6332
                              • Opcode Fuzzy Hash: 17cf35b80b03fcff345a605a7a63ea6e65b0b9a8420bc989c8341716572d16e6
                              • Instruction Fuzzy Hash: DA539630D01258DFDB25CBA4C994BEDBBB4AF09308F64409CD409A7791CB76AE99CF61
                              Function 6CE6C7F3 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1546COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $J
                              • API String ID: 3519838083-1755042146
                              • Opcode ID: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                              • Instruction ID: 39e71a7d397c0c76928b58452f4c92c7573568265c559d5153eb5060fb4d0198
                              • Opcode Fuzzy Hash: bc8a295356575513f6860aba7bf9c3ae3d8e4be31f89be339654daa28ae8d27d
                              • Instruction Fuzzy Hash: ACE29A74A55289DFEF01CFA9C448B9DBBB0AF0630CF348099E855ABB81C774DA45CB61
                              Function 6CE36CE0 Relevance: 5.4, APIs: 1, Strings: 1, Instructions: 1923COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE36CE5
                                • Part of subcall function 6CE0CC2A: __EH_prolog.LIBCMT ref: 6CE0CC2F
                                • Part of subcall function 6CE0E6A6: __EH_prolog.LIBCMT ref: 6CE0E6AB
                                • Part of subcall function 6CE36A0E: __EH_prolog.LIBCMT ref: 6CE36A13
                                • Part of subcall function 6CE36837: __EH_prolog.LIBCMT ref: 6CE3683C
                                • Part of subcall function 6CE3A143: __EH_prolog.LIBCMT ref: 6CE3A148
                                • Part of subcall function 6CE3A143: ctype.LIBCPMT ref: 6CE3A16C
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog$ctype
                              • String ID:
                              • API String ID: 1039218491-3916222277
                              • Opcode ID: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                              • Instruction ID: 0fb5f6995eb443f712e68ea319b70091342fe3f288e23fd10feaa6683373e7b4
                              • Opcode Fuzzy Hash: 905438d877a3164863332086eaa33768b02ac55e5ee0ef1456ae7a8ba4df0a90
                              • Instruction Fuzzy Hash: AE03AA319042A8DEDF15CFA4C990BDCBBB0AF15308F34509ED449A7B91DB746B89CB62
                              Function 6CE8C580 Relevance: 5.2, Strings: 4, Instructions: 153COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: 3J$`/J$`1J$p0J
                              • API String ID: 0-2826663437
                              • Opcode ID: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                              • Instruction ID: 3a9c510728a23d6615c970093e4905bc762d6a0e72b5f57715f09f5e1930698b
                              • Opcode Fuzzy Hash: 0ce0cf568756059b319bec402cc4c845d2048d3ed56d6c8deb0de92fa915ba20
                              • Instruction Fuzzy Hash: 76411572F10A200AB348CE6A8C845667FD3C7CA346B5AC23DD565CA6DDDABDC40782A4
                              Function 6CE60A52 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1212COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: W
                              • API String ID: 3519838083-655174618
                              • Opcode ID: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                              • Instruction ID: b99a04f856155f49845c4aa66532b98c37fe4f37b1e6034b05534285fa53a674
                              • Opcode Fuzzy Hash: ea00faa881669fc0c82860575f49db2074e6a46241474c433f0857494c018303
                              • Instruction Fuzzy Hash: 18B28870A55299DFDB01CFE9C488B9EBBB4AF49308F244099E845EBB42C775ED41CB60
                              Function 6CE61F11 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 511COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID:
                              • API String ID: 3519838083-3916222277
                              • Opcode ID: bf6cc7e3d5e08887c52fb4d73b2e2a9274b9cdfd61b6f8eb1b64b386a2eecc6f
                              • Instruction ID: b36abdfda0868285881af4a932a5a940563e26019050ab49efa0a438043e4379
                              • Opcode Fuzzy Hash: bf6cc7e3d5e08887c52fb4d73b2e2a9274b9cdfd61b6f8eb1b64b386a2eecc6f
                              • Instruction Fuzzy Hash: 202258B0A542099FCB18CFA9C494B9DBBF0BF58308F20855DE8599BB82D774E945CF90
                              Function 6CE54896 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 333COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE5489B
                                • Part of subcall function 6CE55FC9: __EH_prolog.LIBCMT ref: 6CE55FCE
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @ K
                              • API String ID: 3519838083-4216449128
                              • Opcode ID: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                              • Instruction ID: 2d98e30e370863aa586374e5c04b344d8688b2f36898eba5e9bead727d03fe5d
                              • Opcode Fuzzy Hash: 2aafbb27e948f5792f5f0ae65a5e3f4f4742fa89f16e976c1927d8ca4eeab830
                              • Instruction Fuzzy Hash: 23D1FE71D042048FEB54CFA8C4807DEB7B6BB84318F74812BE405ABB85DB729875CB55
                              Function 6CE08EA1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: x=J
                              • API String ID: 3519838083-1497497802
                              • Opcode ID: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                              • Instruction ID: b187f900ca9b7b05582648538e25e34ae835e88969137d94e24c6e14eab564db
                              • Opcode Fuzzy Hash: c284c417a2f68c1c742bc951fc924e558872fa0b35763257f7574c1e26c9a400
                              • Instruction Fuzzy Hash: A3919A32F052099ACF14DFA4D8919EDB772EF4631CF30806ED4A167A51DB32596ACBD0
                              Function 6CE72521 Relevance: 2.6, APIs: 1, Instructions: 1105COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID:
                              • API String ID: 3519838083-0
                              • Opcode ID: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                              • Instruction ID: 232d9ea567bbbad5044526eeda8f1a9b33775181955ec03e5cfb1539c7c992cc
                              • Opcode Fuzzy Hash: 9c3421dad5d14781272ec358f91f3a3ab5cfaafabcf0205709a2c9463218eeaf
                              • Instruction Fuzzy Hash: 8CB29830904748CFDB35CFA9C494B9EBBF1AF15308F20819DD49AABB81D731A985CB61
                              Function 6CE08972 Relevance: 2.6, Strings: 2, Instructions: 91COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: @4J$DsL
                              • API String ID: 0-2004129199
                              • Opcode ID: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                              • Instruction ID: 68e10014a1baa1bafa94a177c80b71a1322f6853ee640221aca9174f61cf7c4a
                              • Opcode Fuzzy Hash: 9b82dfd3553fe836d7aa24bd6b5882a619f6ea42a248f1f14d7e615b1deddf65
                              • Instruction Fuzzy Hash: 2F218F376A4D560BD74CCA68DC33AB93691E745305B88527EE94BCB7E1DE5C8800CA48
                              Function 6CE57D43 Relevance: 1.8, APIs: 1, Instructions: 346COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID:
                              • API String ID: 3519838083-0
                              • Opcode ID: a09d6e82890587311bf3c607534608c3e0df372b1a8eae7fe7b1a33e2057bb73
                              • Instruction ID: 9987f393f83765bac8813540230c0f0ab14c0d04720c1fff1867adae6827a236
                              • Opcode Fuzzy Hash: a09d6e82890587311bf3c607534608c3e0df372b1a8eae7fe7b1a33e2057bb73
                              • Instruction Fuzzy Hash: A6F16A74910249DFCB14CFA8C580BDDBBB1BF05308F64816ED409ABB52D772AA69CF51
                              Function 6CE10BCA Relevance: 1.7, APIs: 1, Instructions: 201COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aullrem
                              • String ID:
                              • API String ID: 3758378126-0
                              • Opcode ID: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                              • Instruction ID: 5cf9593e9e676af307ff38654283792992fa0e018d0603a0816c57c604400530
                              • Opcode Fuzzy Hash: d1b669466a100d6f0f6c84f42758606c7eb5b4ffe16e73214497a835af333093
                              • Instruction Fuzzy Hash: 1551E971A08285DBD710CF5AC4C06EDFBF6EF79214F28C05EE8C897242D27A599AC760
                              Function 6CE89E80 Relevance: 1.7, Strings: 1, Instructions: 424COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID: 0-3916222277
                              • Opcode ID: acb8407a1b1d291f125d5a9761f4a1fdf91c25411dab1fb78ed15b47a431c268
                              • Instruction ID: c78d7cb4b2ee36bfa8503270834d9687f59ad68c4b9fc47f96107e7c53f716e2
                              • Opcode Fuzzy Hash: acb8407a1b1d291f125d5a9761f4a1fdf91c25411dab1fb78ed15b47a431c268
                              • Instruction Fuzzy Hash: 5702AD3164A3808BD725CF28C49079EBBF2EFC9708F244A2DE5C997B91C7759945CB42
                              Function 6CE0C7CF Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: (SL
                              • API String ID: 0-669240678
                              • Opcode ID: 403d64dc1b872b29255918294ce527b86f393edeaddcf848938bb8168c435548
                              • Instruction ID: 97d635a47713a662b5b0d5d7d09730ad01a73aa4c163674ce8bbadf93a467a2e
                              • Opcode Fuzzy Hash: 403d64dc1b872b29255918294ce527b86f393edeaddcf848938bb8168c435548
                              • Instruction Fuzzy Hash: 2B516473E208314AD78CCE24DC2177572D2E784310F8BC1B99D8BAB6E6DD78989587D4
                              Function 6CE7AB90 Relevance: .9, Instructions: 940COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                              • Instruction ID: f74b43ed5cca00b2c7483d2fccf50f03ae05c3e16f7464da3424c3caaa6b6cbb
                              • Opcode Fuzzy Hash: c5d8fce23cbaa16ca4a411120887c85bd9f222070fcab5a8c777e9c9c2b1bfe3
                              • Instruction Fuzzy Hash: 62728DB2A042128FD718CF18C490258FBF1FB89314B6A56ADD95ADB742DB30E8D5CBD1
                              Function 6CE80020 Relevance: .8, Instructions: 762COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3901934d13cb486671902a8639e4417b1e8cd50483714420dc8c7fa42b5c990c
                              • Instruction ID: 40a189187d49713f416453e9d831487106c14c15c03a3892ea72cf517a6b6586
                              • Opcode Fuzzy Hash: 3901934d13cb486671902a8639e4417b1e8cd50483714420dc8c7fa42b5c990c
                              • Instruction Fuzzy Hash: 03524E3160AB858BD728CF29C49076AB7F2BF99308F248A2DD4DAC7B41DB75E445CB41
                              Function 6CE9A930 Relevance: .7, Instructions: 740COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                              • Instruction ID: 1de6147cdd99af3a0884ee6e4cfa7650cc8855e9a49a06a7e667f1db7806bfba
                              • Opcode Fuzzy Hash: bb173c08d896bf76c8f12b9495eb2c2eeed1eb95d4f1202fd14126b970d45cbc
                              • Instruction Fuzzy Hash: E962E2B1A483458FC724CF1AC58061AFBF5BFC9748F248A2EE89987715D770E845CB92
                              Function 6CE98950 Relevance: .7, Instructions: 697COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                              • Instruction ID: f451e213362971fd2ae0f99e613cf0ae0c87659493ababcc56b8d46288cc1687
                              • Opcode Fuzzy Hash: a58f6c5b0b87d5f12fe17b5b5b78f65cee349bf84e9962db46f9d84bc39cd103
                              • Instruction Fuzzy Hash: E7428071604B058FD368CF69C8907AAB3F2FB84358F144A2EE496C7BA4E774E549CB41
                              Function 6CE83D50 Relevance: .5, Instructions: 547COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ae17103ab74f7c7ba27116ddf20acfa1a33030b9793f89cfab32f42cff4eb5f1
                              • Instruction ID: 2591390fc20e087e2bb40b0a65c3ea4d07fa9cf6a61713ac22cb1b5977e2baf1
                              • Opcode Fuzzy Hash: ae17103ab74f7c7ba27116ddf20acfa1a33030b9793f89cfab32f42cff4eb5f1
                              • Instruction Fuzzy Hash: 4C128F7120A7458BC718CF68C4A065AFBF2FFD8348F64492EE99A87B41D731E845CB52
                              Function 6CE94AA0 Relevance: .5, Instructions: 474COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                              • Instruction ID: 7fc996f4752432673a41a02ca71d4a5e743352bd2069315acf6b648f95415939
                              • Opcode Fuzzy Hash: f4c3878cdf6dda1e5ca36c24f377bc52bcf6993d29949e9196dea34e7f5de905
                              • Instruction Fuzzy Hash: E4020A72A083118FD319CE28C490359BBF2FBC5355F294B2FE4A697A94D7709885CB93
                              Function 6CE9E600 Relevance: .5, Instructions: 470COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                              • Instruction ID: 71d24afb63e23ace96ef4065719c62acbfdeecaacae387dab8bbafa854aba873
                              • Opcode Fuzzy Hash: 04f499f9e3d4c93c3ee3b28235ad2abed55ba3d5e2a4d0777d40b1e79efdc42e
                              • Instruction Fuzzy Hash: 2312A070604B518FC324CF2EC494626FBF2BF85305B288A6ED6D687BA1D735E548CB91
                              Function 6CE9C2A0 Relevance: .5, Instructions: 461COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 197aec8a6e2a317b323f6aae5095031827df40ea46c44a9cbc9116775b6008cc
                              • Instruction ID: 21dd4a96306249cd99eaad87d97ac4ef4f4ed165d04fff7481dae4646d9c0cb7
                              • Opcode Fuzzy Hash: 197aec8a6e2a317b323f6aae5095031827df40ea46c44a9cbc9116775b6008cc
                              • Instruction Fuzzy Hash: 6F02C2716087608FC328DF2ED49022AFBF1AF85305F248A6EE5D687B91D335E545CB52
                              Function 6CE86D10 Relevance: .4, Instructions: 429COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                              • Instruction ID: 20dca4984ca6193c9ced00825e4e66648fc2ff8395a924f42931ab03dd8a7458
                              • Opcode Fuzzy Hash: 70a9c9e80daef2df3b25ccf8549349f6a1d4fdfd7731b9f920c9a3da36d7342a
                              • Instruction Fuzzy Hash: F0E1F072705B008BD724CF28D4603AAB7F6EBC4318F64492DD59AC7B81DB35E50ACB92
                              Function 6CE9EBC0 Relevance: .4, Instructions: 399COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                              • Instruction ID: c0d0f4175a5525b357b84f2d8615b54ce3ec3927e67f6c017db994c025999abe
                              • Opcode Fuzzy Hash: 2bbd660b0b6b3ed67628fad2252f6cf995a3246cee064cb0bfa737aff63ec289
                              • Instruction Fuzzy Hash: 4FF19F70608B518FC328CF2DD490266FBF1BB89305F284A6ED1D687B91D339E594CB91
                              Function 6CE9C8D0 Relevance: .4, Instructions: 383COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                              • Instruction ID: b328ebe063e5a22254301697dce9f30e128184d662ffc9dd1b98efd0323a6fe7
                              • Opcode Fuzzy Hash: b0f25bae375294626f84eebbb02985cc894b79d37dbce9afd4d280b88824898c
                              • Instruction Fuzzy Hash: 8DF1D2706087618FC329EF29C49026AFBF1BF85308F288A2ED5D687B91D339E155CB51
                              Function 6CE86900 Relevance: .3, Instructions: 341COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                              • Instruction ID: aa8d6d1287d8351543071d811c04c929f9c93f236da68a5c4876afc9d04ab172
                              • Opcode Fuzzy Hash: 2d001f70021adf80f04e27e8359f5713b9c218b059c1a64901c9b96791ed9031
                              • Instruction Fuzzy Hash: 16C1C071605B068BE328CF2DC4906AAB7F6FBC4314F648A2DC1AAC7B55D634F495CB81
                              Function 6CE8E0E0 Relevance: .3, Instructions: 320COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0be95466a501aa6df6135e314a315b2d27713a5a1a3cbbde2114f59cc96eeb67
                              • Instruction ID: 242a7e571f8399174aa35b36c42d8f275e7c72383974318b277e4ee1e8459f7f
                              • Opcode Fuzzy Hash: 0be95466a501aa6df6135e314a315b2d27713a5a1a3cbbde2114f59cc96eeb67
                              • Instruction Fuzzy Hash: 61B17C766066218FC350CF29C8802557BB2BBC532D77587A9C4A89FB5AD336E807CBD0
                              Function 6CE82580 Relevance: .3, Instructions: 316COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                              • Instruction ID: f38e286be6fd9cf43c878f00e6434e8c55b8575bfb6765e0f585835869d1b06f
                              • Opcode Fuzzy Hash: ae4b2f2b70234ac2bedfdde99fbf7177c16b95a6c2c71cfcccbd0d12063c7eec
                              • Instruction Fuzzy Hash: E1C1D4356047418BC719CE39D0A4297BBF2EFEA318F248A6DC4CE4BB55DA31A40ECB55
                              Function 6CE8E4D0 Relevance: .3, Instructions: 307COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                              • Instruction ID: b6566d30352d05e548920cfaa1121169ef4d816133a598a86d019ecd1d246d76
                              • Opcode Fuzzy Hash: 070d0fd322238de923fe1a2eebb0020640b7b085cfb472be6ac79834afb9933a
                              • Instruction Fuzzy Hash: BFB15C75A066508FC740DF29C884254BBB2BF8532CB79969EC4988F746E337E847CB91
                              Function 6CE7E810 Relevance: .3, Instructions: 296COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                              • Instruction ID: 21d73349754c7dbdacd693a2e4baa65d4a75bcf7f3820396429bf460d398a472
                              • Opcode Fuzzy Hash: d6cb5a5b9c3abea019be7d104db6e1742bcc809bf8f8dd5f8f219f0a705516a1
                              • Instruction Fuzzy Hash: 1EB1BD35304B054BD734DA39C8907EAB7F1AF84708F24492DD5AA87B81EF34B909C7A5
                              Function 6CE899F0 Relevance: .3, Instructions: 287COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 57f28dc9a1232a8c06b083a4d088c40ef3b8ca8235aec33933a76f5351274b3b
                              • Instruction ID: 26deda01f08294ede2a2aec2093a70e54e79b96bcad21afed725902f28f6e3ea
                              • Opcode Fuzzy Hash: 57f28dc9a1232a8c06b083a4d088c40ef3b8ca8235aec33933a76f5351274b3b
                              • Instruction Fuzzy Hash: 35A1E372A0D7418FC318CE29C49069ABBF1AFD5308F644A6DF4DE87B40D631E94ACB46
                              Function 6CE845D0 Relevance: .2, Instructions: 224COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                              • Instruction ID: b4286e9fc82cd77f44fcab5068354e8ad35a43fcc7b1dd73cbbc39439d39c557
                              • Opcode Fuzzy Hash: 7f5f8248f8a18455fd1713549b4a266ce9d34d374119e8c9520886de18fa66fd
                              • Instruction Fuzzy Hash: 8F6171B23092158FD708CFA9E190A56B3E9EB99325B1685BFD109CB361E771DC41CB18
                              Function 6CE98200 Relevance: .2, Instructions: 222COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 482053017e2a7efdb7bc9ab3d96018154e4c77c6c4b2041277a2a90eb64ac0e3
                              • Instruction ID: 94b9c0d850f2c3e389c9d95cac861b1a2b3fe74271a0d337f072f55d3dc9d985
                              • Opcode Fuzzy Hash: 482053017e2a7efdb7bc9ab3d96018154e4c77c6c4b2041277a2a90eb64ac0e3
                              • Instruction Fuzzy Hash: D481F2B2D447298BD710CF88ECC4596B3A1FB88308F0A467DDE591B352D2B9B915DBD0
                              Function 6CE98520 Relevance: .2, Instructions: 216COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                              • Instruction ID: 0b62cd73bb799517d55ddb4c72f9a3279744b4aeb4de961485195c0ca67dc7af
                              • Opcode Fuzzy Hash: 1e144e3ab01ad0c1374fc479d6e69199773169d0809bfde8fbea9fa4d5497ab0
                              • Instruction Fuzzy Hash: 959190B2C1871A8BD314CF18D88025AB7E0FB88308F19067DED99A7352D739EA55CBC5
                              Function 6CE20B66 Relevance: .2, Instructions: 167COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                              • Instruction ID: edb63549202eb215f8b77a07762d0cf80bbb1ce86bc4f0a661037366d615b465
                              • Opcode Fuzzy Hash: e7510d37d1dc4b924ec4f7ba8427fb7a6be5c38a378ebc779dfd7017bf70bacd
                              • Instruction Fuzzy Hash: BE515F72F006099FDB08CF98DDA27ADBBF2EB89308F248169D515E7781D7789A41CB50
                              Function 6CE22EC9 Relevance: .1, Instructions: 136COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                              • Instruction ID: 48e414daab3d6fd9fed587909c6c978175f9830fad2634f2a06717d30b357bad
                              • Opcode Fuzzy Hash: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                              • Instruction Fuzzy Hash: EB3114277B440103D71DC92BCC1679FA1675BE423A71EDB396C05DAF59D52CC8125144
                              Function 6CE8EEF0 Relevance: .1, Instructions: 123COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                              • Instruction ID: 33292eec9457cf43e7118a9e96c883fcae35857ea48c50dc6541bcf22a3ed3b8
                              • Opcode Fuzzy Hash: 2e506fc7279a820970dcbf9ac392f20d839b71f7c0b8c4e9d2c3673edf14b0ee
                              • Instruction Fuzzy Hash: EC31087B506E050EF201852A8D853567233DBC236CF3A8775D96E87FECCA7598078281
                              Function 6CE96820 Relevance: .1, Instructions: 112COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                              • Instruction ID: 711b3ba65d0a186d3a1de5fff6d3b9f7a13ba8d55118dad54ceb4089b0ea8e32
                              • Opcode Fuzzy Hash: 69d074c34a2def6d804bdbc3328af019823b1a6a4464c67451b70719eeaddbc9
                              • Instruction Fuzzy Hash: 2041B0B29047069BD704CF19C89056AB3F4FF88358F554A2EED5AA7381E334EA25CBC1
                              Function 6CE967A0 Relevance: .0, Instructions: 41COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                              • Instruction ID: 3b0a7877fdfb78d2b8ba94a8d29361ac2fb0c4ffade803227d2c37923e911fef
                              • Opcode Fuzzy Hash: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                              • Instruction Fuzzy Hash: B0018C72914A2E97DB289F48CC41136B394FB85312F49823AED879B389E734F970C6D4
                              Function 6CE3EB50 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 341COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$p&L$p&L$p&L$p&L$p&L$p&L$p&L$p&L
                              • API String ID: 3519838083-609671
                              • Opcode ID: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                              • Instruction ID: 2f18098a82e9f80a66a795e72ab024adb0a1f9c96113e918ae66c5633ac3dc98
                              • Opcode Fuzzy Hash: 484af5ae81cb977d174bd25b2e3a21fa57463062f16cd0331cc52001b19bc208
                              • Instruction Fuzzy Hash: 7FD1BE71A0461ADFCB11CFA4D980AEEB7B5FF45308F345569E059A3A90DB70BD09CBA0
                              Function 6CE53CB2 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 347COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $ $$ K$, K$.$o
                              • API String ID: 3519838083-1786814033
                              • Opcode ID: 8aabfd49f75e4689d5c64928821ac6bb4626587af6c0d6ffd44deb225edb8441
                              • Instruction ID: 5f138c05ce88c41397e59f3953b5e9eec6004f2e8e95c200ca2a33a7f1e1a24c
                              • Opcode Fuzzy Hash: 8aabfd49f75e4689d5c64928821ac6bb4626587af6c0d6ffd44deb225edb8441
                              • Instruction Fuzzy Hash: 4AD1D431A042598BCB11CFA8D8907EEB7F2BF0630CFB4426AC555ABB41C7735965CB61
                              Function 6CE26798 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 461COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv$H_prolog
                              • String ID: >WJ$x$x
                              • API String ID: 2300968129-3162267903
                              • Opcode ID: 949a4121937ebe046e830a9d183576ad129ffcf0ce56193b78953cd7febb835e
                              • Instruction ID: aa7a89ac674f32d185fda80b695b3ba3216a6889ec3862f55d0c08e2bbdba044
                              • Opcode Fuzzy Hash: 949a4121937ebe046e830a9d183576ad129ffcf0ce56193b78953cd7febb835e
                              • Instruction Fuzzy Hash: 8A124771900209EFDF14DFA4C880AEDBBB9FF48318F34866DE915AB690DB399945CB50
                              Function 6CE14FA6 Relevance: 9.1, APIs: 6, Instructions: 95COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv$__aullrem
                              • String ID:
                              • API String ID: 2022606265-0
                              • Opcode ID: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                              • Instruction ID: 15c181e41d3395f5992194e7322aff48388b5c09c3eafbbd9da188b13e0052b8
                              • Opcode Fuzzy Hash: 1f394eef11d621d2b0abd6c005444ee54f283a007719147bbe3c0d60170dbe25
                              • Instruction Fuzzy Hash: 0521CE71906219BFDF20CED58C80DDF7A7AEF417ECF30822AF52065A94D2718DA1D6A1
                              Function 6CE1A6EC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 183COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE1A6F1
                                • Part of subcall function 6CE29173: __EH_prolog.LIBCMT ref: 6CE29178
                              • __EH_prolog.LIBCMT ref: 6CE1A8F9
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: IJ$WIJ$J
                              • API String ID: 3519838083-740443243
                              • Opcode ID: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                              • Instruction ID: 7d65a057059d04597e7412b410d3281d93f8d1c8b20b2921636ece725d846cb2
                              • Opcode Fuzzy Hash: 6052f957e2ecb8a4b70827f611eacceb93b83a0f35a243b049cc0090dc05215c
                              • Instruction Fuzzy Hash: C771BF30A44259DFDB14DFA4C444BEDB7B0BF15308F2080ADD855ABB91CB78AA5DCB90
                              Function 6CE6384E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE63853
                                • Part of subcall function 6CE635DF: __EH_prolog.LIBCMT ref: 6CE635E4
                                • Part of subcall function 6CE63943: __EH_prolog.LIBCMT ref: 6CE63948
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: ((K$<(K$L(K$\(K
                              • API String ID: 3519838083-3238140439
                              • Opcode ID: cede27c3a22cca09b7bd7d03a45c990e4592a35e63268caaaf0da1c0b765a472
                              • Instruction ID: 6307523acf4273099491f74ae948a8531f2695516f2607cd10109dc49b13667d
                              • Opcode Fuzzy Hash: cede27c3a22cca09b7bd7d03a45c990e4592a35e63268caaaf0da1c0b765a472
                              • Instruction Fuzzy Hash: 78214DB0911B40DEC724DF6AC55469BFBF4EF55308F208A1F80A697B50D7B46608CB65
                              Function 6CE2E418 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE2E41D
                                • Part of subcall function 6CE2EE40: __EH_prolog.LIBCMT ref: 6CE2EE45
                                • Part of subcall function 6CE2E8EB: __EH_prolog.LIBCMT ref: 6CE2E8F0
                                • Part of subcall function 6CE2E593: __EH_prolog.LIBCMT ref: 6CE2E598
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: &qB$0aJ$A0$XqB
                              • API String ID: 3519838083-1326096578
                              • Opcode ID: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                              • Instruction ID: 7163ef3aa06cb03b6872a05d88b97c9e680d67d8c0db6bf96c76e766d6213344
                              • Opcode Fuzzy Hash: 37b22e6d00aae0832323933771e16052884702a18d16bc22ef1d28b2cb01d7a1
                              • Instruction Fuzzy Hash: D6218B71E01358EECB04DBE4D995AEDBBB4AF15318F20402EE41267781DB780E0CCB91
                              Function 6CE2E234 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 43COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: J$0J$DJ$`J
                              • API String ID: 3519838083-2453737217
                              • Opcode ID: 94eb96797db7bdd6310de836df89d4e5c2fb6b25f25e237953e0bbd1ee8067ab
                              • Instruction ID: 845a67f85b5c33d8029e367e992c55aca8ab8167aa137b2b0a9218ead9ee6825
                              • Opcode Fuzzy Hash: 94eb96797db7bdd6310de836df89d4e5c2fb6b25f25e237953e0bbd1ee8067ab
                              • Instruction Fuzzy Hash: F911B0B1900B64CEC7249F5AC45469AFBF4BFA5708B10C91FC4A687B50C7F8A508CB99
                              Function 6CE56E3F Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 452COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $!$@
                              • API String ID: 3519838083-2517134481
                              • Opcode ID: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                              • Instruction ID: 2fd87f75ddde7e83bdbe043de3f34d16e15549197f423913c4c72a7100269ac4
                              • Opcode Fuzzy Hash: de11a10d9dafd4c65deb6d7f74020d514e490535ea8bbecf2d37e3263791df61
                              • Instruction Fuzzy Hash: 2612AF74E15249DFCF04CFA4C490ADDBBB5BF09308F64846DE845ABB51CB32A9A5CB60
                              Function 6CE22B91 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 284COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog__aulldiv
                              • String ID: $SJ
                              • API String ID: 4125985754-3948962906
                              • Opcode ID: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                              • Instruction ID: e90258d8fafeb3d8dabaa842c335a2fb16a248b1b88b39f9c90e4caea992b271
                              • Opcode Fuzzy Hash: 589161b9174e713d87cd7ea6b7fb48598b4f41844aead815dae59d281551bb28
                              • Instruction Fuzzy Hash: 2BB15EB1D102099FCB14CFA5C884AEEBBB5FF58328F70852EE415A7B50D738AA45CB50
                              Function 6CE261D6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: $CK$CK
                              • API String ID: 3519838083-2957773085
                              • Opcode ID: 2704db3354b84918023bfe159d178872147a663a780c49e5ab543107787eea7d
                              • Instruction ID: 248232b052c9d472ebfc0b1212b789fd8b7cc954676b9195bed429f205d6abfc
                              • Opcode Fuzzy Hash: 2704db3354b84918023bfe159d178872147a663a780c49e5ab543107787eea7d
                              • Instruction Fuzzy Hash: 9F219271E41205CBCB04DFE8C4802EEB7BAFB95308F74472EC512E7B91C7784A068AA1
                              Function 6CE34EC7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE34ECC
                                • Part of subcall function 6CE1F58A: __EH_prolog.LIBCMT ref: 6CE1F58F
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: :hJ$dJ$xJ
                              • API String ID: 3519838083-2437443688
                              • Opcode ID: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                              • Instruction ID: 2cd2eae921ca795cd9e0d22ea53a188a176a1f1f97037fb99654c2fe2c0b646f
                              • Opcode Fuzzy Hash: e3ee415979c90d2d15618e5f431c2d86ccd996bf58f825059be4d34af7dc85d3
                              • Instruction Fuzzy Hash: 5321DCB0901B40CFC760DF6AC14468ABBF4BF19704B10C96EC1AA97B11D7B8A508CF95
                              Function 6CE2BD0E Relevance: 6.4, Strings: 5, Instructions: 105COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: <J$DJ$HJ$TJ$]
                              • API String ID: 0-686860805
                              • Opcode ID: b82db92acc6f2fd2fd2fd5332bfa7d1e38ecda44958a76cbd211a3f1299ff4ed
                              • Instruction ID: 857e4ef59e96a419a606b079054f9cc22b3cfb5be10eea1349fca6f20a50c274
                              • Opcode Fuzzy Hash: b82db92acc6f2fd2fd2fd5332bfa7d1e38ecda44958a76cbd211a3f1299ff4ed
                              • Instruction Fuzzy Hash: 62419D70D4528DAFCF14DBA0D490AEEB774BF2120CB30C1ADD22267E50EB39A659CB41
                              Function 6CE26331 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv
                              • String ID:
                              • API String ID: 3732870572-0
                              • Opcode ID: 2bdaa92217569021002d8658a142890db49ae38c047720c0e1f220da2750cc6e
                              • Instruction ID: 8b225962ac142f2a739e489fbf22ae99770d34a83112a36ef9b820dadc45fb93
                              • Opcode Fuzzy Hash: 2bdaa92217569021002d8658a142890db49ae38c047720c0e1f220da2750cc6e
                              • Instruction Fuzzy Hash: 0111D272200204BFEB248AA1CC80FAF7BBDEFC9758F20852DB14156A50C675AC05D720
                              Function 6CE0E072 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 398COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE0E077
                                • Part of subcall function 6CE0DFF5: __EH_prolog.LIBCMT ref: 6CE0DFFA
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: :$\
                              • API String ID: 3519838083-1166558509
                              • Opcode ID: 48f4411e2405fcdde49591215dd3ffd545f97566ccde13c94e17e7da02f2e48f
                              • Instruction ID: e26d31d8a687ca482cc15195b7da27c6e4680ca870131a2597fff24b16ea6e06
                              • Opcode Fuzzy Hash: 48f4411e2405fcdde49591215dd3ffd545f97566ccde13c94e17e7da02f2e48f
                              • Instruction Fuzzy Hash: EAE1BE31B00A099ACB10DFA4C890BEDB7B1AF0531CF30452DD49567B91EB75A66ACBD1
                              Function 6CE33C20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 224COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$hfJ
                              • API String ID: 3519838083-1391159562
                              • Opcode ID: 82ac28e14911e15d6061b9e8fa7e1011da5464f288955fede779c14a83bf3726
                              • Instruction ID: 37c91c8252740bcc60e9c60fd3d660c45a91560002ea6db39430aff371b19199
                              • Opcode Fuzzy Hash: 82ac28e14911e15d6061b9e8fa7e1011da5464f288955fede779c14a83bf3726
                              • Instruction Fuzzy Hash: 30913670910358EFCB20DF99C8849DEFBF4BF18308F60551EE159A7A90D770AA49CB50
                              Function 6CE28C58 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE28C5D
                                • Part of subcall function 6CE2761A: __EH_prolog.LIBCMT ref: 6CE2761F
                                • Part of subcall function 6CE27A2E: __EH_prolog.LIBCMT ref: 6CE27A33
                                • Part of subcall function 6CE28EA5: __EH_prolog.LIBCMT ref: 6CE28EAA
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: WZJ
                              • API String ID: 3519838083-1089469559
                              • Opcode ID: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                              • Instruction ID: e858ee45d21c9350a3a28e79ad21fa81bd07af5d0d5e0b911039837e4c0a245a
                              • Opcode Fuzzy Hash: cff2a95f7f2c9e7e47c21d6c2cae1b51bbda01fa4771d0427a5cf66fef2ba2b2
                              • Instruction Fuzzy Hash: 53816A32D00158DFCF25DFA8D890ADDB7B4AF18318F20409EE516A77A0DB346A49CBA1
                              Function 6CE5A3DF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog__aullrem
                              • String ID: d%K
                              • API String ID: 3415659256-3110269457
                              • Opcode ID: ac62a312e9615e63fe83044f2985e6da76b9d9f2e0a1fb3315288c38c591097e
                              • Instruction ID: b7d61c2fffb8cbbbf094c39caaff985da6c918b4493828826c0f92317de04b26
                              • Opcode Fuzzy Hash: ac62a312e9615e63fe83044f2985e6da76b9d9f2e0a1fb3315288c38c591097e
                              • Instruction Fuzzy Hash: 4C61A972A412498BDF01CFA4C444BFEB7B1AF4530DF748058D814ABB85C772DA19CBA1
                              Function 6CE565B2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: CK$CK
                              • API String ID: 3519838083-2096518401
                              • Opcode ID: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                              • Instruction ID: e64456468acc3e5ab78a1ed657b3197df8a14597e08dbcc0a222bbfcf673276c
                              • Opcode Fuzzy Hash: 1b70a559b70f3d65bd2f661337f76f78bd0a11403a28fe7c91f6bbd835c02544
                              • Instruction Fuzzy Hash: 5B518275A00305DFDB00CFA4C8C4BEEB3B9FB88358F648519D911EB745DB76A9158B60
                              Function 6CE2FF9C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: <dJ$Q
                              • API String ID: 3519838083-2252229148
                              • Opcode ID: 8611fd72bf4170e71673488c417c1a53bfaf30d487d7fd955d74d6e9e56554ac
                              • Instruction ID: 11f35dc69fed3dcf610bd5f8270fa6fc630a43b8352705ac1f432dfb1bc38313
                              • Opcode Fuzzy Hash: 8611fd72bf4170e71673488c417c1a53bfaf30d487d7fd955d74d6e9e56554ac
                              • Instruction Fuzzy Hash: 1A517D71A04299EFCF10DF94C8808EDB7B1BF49318F20852EE515ABB50D735AA5ACF50
                              Function 6CE3014A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: PdJ$Q
                              • API String ID: 3519838083-3674001488
                              • Opcode ID: 87eb3cb62c03194caae5458ff4b741e3c8b0552ef8959399e26f931c5ab5bbcd
                              • Instruction ID: 8f3706bc63ee98b58d8b385be1c46df5b4153bd281906ef1708d7a39520a3608
                              • Opcode Fuzzy Hash: 87eb3cb62c03194caae5458ff4b741e3c8b0552ef8959399e26f931c5ab5bbcd
                              • Instruction Fuzzy Hash: 2C41A176D00269DBCB11DFA8C4909EDF3B4FF49318F20912EE929A7B50D330A945CB98
                              Function 6CE44C24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: 0|J$`)L
                              • API String ID: 3519838083-117937767
                              • Opcode ID: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                              • Instruction ID: b5fafabe08cfaf38f6f6636885dc3db903937a8b395f0731b389f668fa42c48a
                              • Opcode Fuzzy Hash: 924921a2771934cbe07cb1819a4d5bd42f54cfcb7b164b76471555bcaac8b42b
                              • Instruction Fuzzy Hash: 00418F31705785EFDB118FA4D490BEEBBB2FF45208F24842EE05A9B750CB356914CB92
                              Function 6CE47CB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: __aulldiv
                              • String ID: 3333
                              • API String ID: 3732870572-2924271548
                              • Opcode ID: 0d34d547a1763b1f6cbcb81569cbe66ca114cba913daa42be50c89cb46dd64ee
                              • Instruction ID: 2dded5f547d0c8797a44aa132cd0ca169e4077b6558b9d72b8b6e35bae539846
                              • Opcode Fuzzy Hash: 0d34d547a1763b1f6cbcb81569cbe66ca114cba913daa42be50c89cb46dd64ee
                              • Instruction Fuzzy Hash: 172197B19407046FD730CFB98880BABFAFDEB45758F20891EA186D7B40D770A945CBA5
                              Function 6CE40906 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$LuJ
                              • API String ID: 3519838083-205571748
                              • Opcode ID: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                              • Instruction ID: e7f2cf76546cd2aa90d8d0c5b349225b5012711c997d330847ebd709882c66a2
                              • Opcode Fuzzy Hash: aa36ca613ac24c818774a3b50af302aa3ac6c7e5dc6eeb3b6f96232f2efdcf83
                              • Instruction Fuzzy Hash: 3D01A1B2E05245DADB10DF9984805AEF7B4FFA9308F60D43EE129E3B40C3345905CB55
                              Function 6CE1C0AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: @$xMJ
                              • API String ID: 3519838083-951924499
                              • Opcode ID: 871999b8a6dfe8dd14063548d73ca1d86140603a6c3ba165e22a59db3157078a
                              • Instruction ID: 442f9e441a5f5f3b90f20e8eaca945f23aa356488888694ab1bbfd4a9653b15e
                              • Opcode Fuzzy Hash: 871999b8a6dfe8dd14063548d73ca1d86140603a6c3ba165e22a59db3157078a
                              • Instruction Fuzzy Hash: E8117C72B44249DBCB00DFE9C49059EB7B4FF19358B60C42ED469E7B00D3389A16CB95
                              Function 6CE6C5D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: p/K$J
                              • API String ID: 3519838083-2069324279
                              • Opcode ID: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                              • Instruction ID: 790e3b7461dbd97a6602f4b09ad67e5a5b8ca125bc75cfe426e03751d9b827f2
                              • Opcode Fuzzy Hash: aa294a1bc2fd733ef3206d587f87cb87e74aa4de150a5e8f5598fd7d05bcf4d2
                              • Instruction Fuzzy Hash: 2D01BCB1A117119FD724CF99D5043AEB7F8EF55729F20C81ED096A3B40C7F8A5088BA8
                              Function 6CE4AFC7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE4AFCC
                                • Part of subcall function 6CE4A4D1: __EH_prolog.LIBCMT ref: 6CE4A4D6
                                • Part of subcall function 6CE4914B: __EH_prolog.LIBCMT ref: 6CE49150
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: J$0J
                              • API String ID: 3519838083-2882003284
                              • Opcode ID: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                              • Instruction ID: 6bceb82f86648124919f9239a73b262641eaafd94a84f60b7217fcd48e6b4fdc
                              • Opcode Fuzzy Hash: e6d3612d4e81af9a8d93b7ad1b32697a4da849f1579351cb7c1b36bc92f9105d
                              • Instruction Fuzzy Hash: AE01C5B1804B51CFC325CF5AC5A468AFBF4BB15704FA0C95EC0A657B50D7B8A508CB68
                              Function 6CE443F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 6CE443F9
                                • Part of subcall function 6CE44320: __EH_prolog.LIBCMT ref: 6CE44325
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prolog
                              • String ID: `)L$|{J
                              • API String ID: 3519838083-2198066115
                              • Opcode ID: b90d896587ff69ee453e80d465c2f6f8c7b83dee329af48c731e2e2cf544007c
                              • Instruction ID: a353582e615489f6fc5d2695213d36d3e5572a12564160a1576cfd5e67794c3c
                              • Opcode Fuzzy Hash: b90d896587ff69ee453e80d465c2f6f8c7b83dee329af48c731e2e2cf544007c
                              • Instruction Fuzzy Hash: C4F08C76610014FFCB059F94DC04BDEBBBAFF49714F00802AF515A6650CBB56A15CBA8
                              Function 6CE3A143 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID: H_prologctype
                              • String ID: <oJ
                              • API String ID: 3037903784-2791053824
                              • Opcode ID: f66cbee60b40af54c04d64295f8ed3aa4e69c018a581ef3e0b0762c85e8ebc26
                              • Instruction ID: 8b56a12bbe9c6fede4600eefe2aa0e979f0d2fe93e046b04a337be43bf992c2f
                              • Opcode Fuzzy Hash: f66cbee60b40af54c04d64295f8ed3aa4e69c018a581ef3e0b0762c85e8ebc26
                              • Instruction Fuzzy Hash: CAE0E572A515209FDB049F88D810BDEF7B4EF45718F21001EE015A7B81CBB1A804C680
                              Function 6CE64E19 Relevance: 5.2, Strings: 4, Instructions: 161COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: D)K$H)K$P)K$T)K
                              • API String ID: 0-2262112463
                              • Opcode ID: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                              • Instruction ID: 565647a544ea4462591d57d28d93419b1f1666f281c6c86e702e0f90492c0d38
                              • Opcode Fuzzy Hash: db2bed83cd242086b620a75a277d992f39b5cdae26f25bede05caa2e01ee838f
                              • Instruction Fuzzy Hash: E4519D31A94209DBCF01DF92E850ADEB7B1EF0532CF30442EE85167F90DB75A969CA91
                              Function 6CE84F20 Relevance: 5.0, Strings: 4, Instructions: 27COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000006.00000002.1558338972.000000006CE08000.00000008.00000001.01000000.00000009.sdmp, Offset: 6CE08000, based on PE: true
                              • Associated: 00000006.00000002.1558928028.000000006CED3000.00000004.00000001.01000000.00000009.sdmpDownload File
                              • Associated: 00000006.00000002.1558955224.000000006CED9000.00000020.00000001.01000000.00000009.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_6_2_6cc50000_#U5b89#U88c5#U52a9#U624b2.jbxd
                              Similarity
                              • API ID:
                              • String ID: (?K$8?K$H?K$CK
                              • API String ID: 0-3450752836
                              • Opcode ID: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                              • Instruction ID: df8a41d2b5471a682fcebec631ba6c4c114ee4947899b8460f690e3024b5c800
                              • Opcode Fuzzy Hash: d4c246a701e4ab7ba432eee481bca3e782bec61bf51628d32b3eb083001bfa55
                              • Instruction Fuzzy Hash: 3AF030B15027009FC320CF45D54869BF7F8EB45709F50C91FE0AA9BB40D3B8A5088FA8